Use-after-free in Linux kernel - CVE-2026-64221

Vulnerability identifier: #VU139789

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-64221

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ti-qspi driver when handling DMA setup failure during probe. A local user can trigger a DMA setup failure and subsequent use of a released DMA channel pointer to cause a denial of service.

The issue occurs when the driver falls back to PIO mode after DMA setup failure.

Linux kernel
Ubuntu
linux-intel-iot-realtime (Ubuntu package)
linux-intel-iotg (Ubuntu package)
linux-azure-5.15 (Ubuntu package)
linux-gcp-5.15 (Ubuntu package)
linux-azure-fips (Ubuntu package)
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-nvidia-bos (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-intel-iot-realtime (Ubuntu package) - addressed in versions 5.15.0-1104.106, 5.15.0.1104.108, 5.15.0-1107.113~20.04.1
linux-intel-iotg (Ubuntu package) - addressed in versions 5.15.0.1107.106, 5.15.0-1107.113
linux-azure-5.15 (Ubuntu package) - addressed in versions 5.15.0-1109.115~20.04.1, 5.15.0-1117.126~20.04.1, 5.15.0-1117.126~20.04.2
linux-gcp-5.15 (Ubuntu package) - update to 5.15.0-1112.122~20.04.1
linux-azure-fips (Ubuntu package) - addressed in versions 5.15.0.1117.102, 5.15.0-1117.126+fips1
linux (Ubuntu package) - addressed in versions 6.8.0-139.139+fips1, 6.8.0-1049.53, 6.8.0-1062.65+fips1, 6.8.0-1062.65.1, 6.8.0-1062.65~22.04.1, 6.8.0-1062.70, 6.8.0-1064.68, 6.8.0-1067.75, 6.8.0-1067.75+fips1, 6.8.1-1059.60, 6.8.1-1059.60~22.04.1
linux-aws (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1015.15
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-nvidia (Ubuntu package) - addressed in versions 7.0.0-1016.16, 7.0.0-1016.16~24.04.1
linux-nvidia-bos (Ubuntu package) - update to 7.0.0-2016.16

• https://git.kernel.org/stable/c/178b9b570c0f75fa7e691490520328b20d19138e
• https://git.kernel.org/stable/c/1cd927002120678bd5d23c760246639caa53040e
• https://git.kernel.org/stable/c/3bbbe7ae3fdada0df4157c1ffe989f92dfa8dcd6
• https://git.kernel.org/stable/c/9c6f306a8140962c7284197db54b96fdb5f468d6
• https://git.kernel.org/stable/c/d6f422b122922d1abee907d673bcc990e5f3672d
• https://git.kernel.org/stable/c/d7a076fb596c7b408ed6df74793a597990a6d860
• https://git.kernel.org/stable/c/ea6ec3343e05f7937a53eb6d7617b3abdb4abc19
• https://git.kernel.org/stable/c/f2dc841d7dc9063fe9b47ced869b1271e55052ae

• Use-after-free in Linux kernel spi driver
• Ubuntu update for linux-azure-5.15
• Ubuntu update for linux-aws
• Ubuntu update for linux-azure-fips
• Ubuntu update for linux-intel-iot-realtime
• Ubuntu update for linux-intel-iotg
• Ubuntu update for linux-nvidia-bos
• Ubuntu update for linux-nvidia
• Ubuntu update for linux-gcp-5.15
• Ubuntu update for linux
• Ubuntu update for linux-gcp-7.0