PT-2026-61390 · Linux · Linux

CVE-2026-64073 · Publicado 2026-07-19 · Atualizado 2026-07-19

Mitre

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

irq work: Fix use-after-free in irq work single() on PREEMPT RT

On PREEMPT RT, non-HARD irq work runs in per-CPU kthreads via run irq workd(), so irq work sync() uses rcuwait() to wait for BUSY==0.

After irq work single() clears BUSY via atomic cmpxchg(), it still dereferences @work for irq work is hard() and rcuwait wake up().

An irq work sync() caller on another CPU that enters after BUSY is cleared can observe BUSY==0 immediately, return, and free the work before those accesses complete — causing a use-after-free.

Fix this by wrapping run irq workd() in guard(rcu)() so that the entire irq work single() execution is within an RCU read-side critical section. Then add synchronize rcu() in irq work sync() after rcuwait wait event() to ensure the caller waits for the RCU grace period before returning, preventing premature frees.

Correção

Identificadores relacionados

CVE-2026-64073

Produtos afetados

Linux

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-64073 · Nota de Segurança
• https://git.kernel.org/stable/c/eef4f71b46a9929ac33e968538c9dd5d96a02460 · Nota
• https://git.kernel.org/stable/c/91840be8f710370607f949a627e070896faeddb8 · Nota
• https://git.kernel.org/stable/c/81b582784518196eff1050212a046bc29d3a05dd · Nota
• https://git.kernel.org/stable/c/2dc79362302922cb18f35e262712b5e58de65442 · Nota
• https://git.kernel.org/stable/c/684a78183c54c23e70d1cba320f7fc184604210b · Nota
• https://git.kernel.org/stable/c/18c0456ea2615b1a743a6db739c74411c3b42bc6 · Nota