Use-after-free in Linux kernel - CVE-2026-92481
Published: September 18, 2026
Vulnerability identifier: #VU151031
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-92481
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to cause a denial of service.
The vulnerability exists due to a use-after-free in the MediaTek EINT interrupt resource cleanup when unbinding a module. A local privileged user can unbind a MediaTek pinctrl module, leaving a chained interrupt handler referencing freed data, to cause a denial of service.
Affected software
Linux kernel
How to mitigate CVE-2026-92481
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/23252bc1cd9a58a039c9b1ae77b22d2b33da48e9
- https://git.kernel.org/stable/c/51552c8c60d3b1fecc062eab2d8cfeaa1cb339dd
- https://git.kernel.org/stable/c/7f6d898179ca4771ee602bdad4246c3952af83eb
- https://git.kernel.org/stable/c/88292b7103d260e3e606eb3bb2794060a5fde48e
- https://git.kernel.org/stable/c/903a7cdf63a81d3738594c5bd1b5955f58fda427
- https://git.kernel.org/stable/c/e06785cba7f86d72abd531058b1a82d6952a7346