PT-2026-61390 · Linux · Linux

CVE-2026-64073 · Published 2026-07-19 · Updated 2026-07-19

Mitre

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

irq work: Fix use-after-free in irq work single() on PREEMPT RT

On PREEMPT RT, non-HARD irq work runs in per-CPU kthreads via run irq workd(), so irq work sync() uses rcuwait() to wait for BUSY==0.

After irq work single() clears BUSY via atomic cmpxchg(), it still dereferences @work for irq work is hard() and rcuwait wake up().

An irq work sync() caller on another CPU that enters after BUSY is cleared can observe BUSY==0 immediately, return, and free the work before those accesses complete — causing a use-after-free.

Fix this by wrapping run irq workd() in guard(rcu)() so that the entire irq work single() execution is within an RCU read-side critical section. Then add synchronize rcu() in irq work sync() after rcuwait wait event() to ensure the caller waits for the RCU grace period before returning, preventing premature frees.

Fix

Related Identifiers

CVE-2026-64073

Affected Products

Linux

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-64073 · Security Note
• https://git.kernel.org/stable/c/eef4f71b46a9929ac33e968538c9dd5d96a02460 · Note
• https://git.kernel.org/stable/c/91840be8f710370607f949a627e070896faeddb8 · Note
• https://git.kernel.org/stable/c/81b582784518196eff1050212a046bc29d3a05dd · Note
• https://git.kernel.org/stable/c/2dc79362302922cb18f35e262712b5e58de65442 · Note
• https://git.kernel.org/stable/c/684a78183c54c23e70d1cba320f7fc184604210b · Note
• https://git.kernel.org/stable/c/18c0456ea2615b1a743a6db739c74411c3b42bc6 · Note