CVE-2026-64188

Analyzed Analyzed - Analysis Complete

Use-After-Free in Qualcomm rmnet Kernel Driver

Publication date: 2026-07-20

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() rmnet_dellink() removes the endpoint from the hash table with hlist_del_init_rcu() and then immediately frees it with kfree(). However, RCU readers on the receive path (rmnet_rx_handler -> __rmnet_map_ingress_handler) may still hold a reference to the endpoint and dereference ep->egress_dev after the memory has been freed. The endpoint is a kmalloc-32 object, and the stale read at offset 8 corresponds to the egress_dev pointer. BUG: unable to handle page fault for address: ffffffffde942eef Oops: 0002 [#1] SMP NOPTI CPU: 1 UID: 0 PID: 137 Comm: poc_write Not tainted 7.0.0+ #4 PREEMPTLAZY RIP: 0010:rmnet_vnd_rx_fixup (rmnet_vnd.c:27) Call Trace: <TASK> __rmnet_map_ingress_handler (rmnet_handlers.c:48 rmnet_handlers.c:101) rmnet_rx_handler (rmnet_handlers.c:129 rmnet_handlers.c:235) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6096) __netif_receive_skb_one_core (net/core/dev.c:6208) netif_receive_skb (net/core/dev.c:6467) tun_get_user (drivers/net/tun.c:1955) tun_chr_write_iter (drivers/net/tun.c:2003) vfs_write (fs/read_write.c:688) ksys_write (fs/read_write.c:740) </TASK> Add an rcu_head field to struct rmnet_endpoint and replace kfree() with kfree_rcu() so the endpoint memory remains valid through the RCU grace period. Also remove the rmnet_vnd_dellink() call and inline only the nr_rmnet_devs decrement, since rmnet_vnd_dellink() would set ep->egress_dev to NULL during the grace period, creating a data race with lockless readers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-08-11

Generated

2026-08-30

AI Q&A

2026-07-20

EPSS Evaluated

2026-08-29

NVD

CVE-2026-64188

EUVD

EUVD-2026-46008

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.177 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.144 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.95 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.211 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.37 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.14 (exc)
linux	linux_kernel	From 4.14 (inc) to 5.10.260 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's Qualcomm rmnet driver. The issue occurs in rmnet_dellink() where an endpoint is removed from a hash table and immediately freed with kfree(). However, RCU readers may still hold references to the endpoint and access freed memory, causing a page fault. The fix involves adding an rcu_head field to the endpoint structure and using kfree_rcu() to defer memory freeing until after RCU readers complete.

Detection Guidance

This vulnerability is specific to the Linux kernel's rmnet driver and may not have direct detection commands. Monitor kernel logs for page faults or oops messages related to rmnet or network drivers. Check for crashes in network handling processes.

Impact Analysis

This vulnerability could cause system crashes (kernel oops) or unexpected behavior when network traffic is processed. Attackers might exploit it to trigger denial-of-service conditions or gain unauthorized access to kernel memory. Systems using Qualcomm rmnet interfaces are particularly affected.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's rmnet driver that could lead to memory corruption or crashes. While it does not directly impact compliance with standards like GDPR or HIPAA, such vulnerabilities can indirectly affect compliance by compromising system integrity, availability, or confidentiality of sensitive data processed by affected systems.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the issue. If immediate patching is not possible, consider disabling the rmnet module if not in use. Monitor vendor advisories for updates.

Hi! I’m here to help you understand CVE-2026-64188. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70