Improper resource shutdown or release in Linux kernel - CVE-2026-64248
Published: July 27, 2026
Vulnerability identifier: #VU139739
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64248
CWE-ID: CWE-404
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper shutdown handling in stop_this_cpu() when processing reboot or shutdown operations after secondary CPUs are parked. A local user can trigger a reboot or shutdown sequence to cause a denial of service.
The issue affects MIPS systems where RCU continues waiting for quiescent states from parked CPUs, which can cause the reboot or shutdown process to hang.
Affected software
Linux kernel
How to mitigate CVE-2026-64248
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/6eda71977ee11c222f8ad4cae4d18d50448e56f4
- https://git.kernel.org/stable/c/9f3f3bdc6d9dac1a5a8262ee7ad0f2ff1527a7e7
- https://git.kernel.org/stable/c/9fef09df42df55ab819b285ea892e0fc1b95a9c4
- https://git.kernel.org/stable/c/e1919d026706544cb6e7251ec06e908edd6f34ee
- https://git.kernel.org/stable/c/f8a1ef884013dc99f712d3eb75624c7cd3fd94f6
- https://git.kernel.org/stable/c/f9b57a0015c241274651f4b36627f56b1b5a8651