CVE-2026-81008

Received Received - Intake

Use After Free in Linux Kernel Interconnect Subsystem

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: interconnect: Fix use after free in icc_get() and of_icc_get_by_index() In of_icc_get_by_index() and icc_get(), if the dynamic allocation for path->name fails via kasprintf(), the error handling path directly calls kfree(path) to free the path object and returns an error. However, prior to this point, path_find() calls path_init(), which already links the path's requests into the req_list of the respective interconnect nodes via hlist_add_head(). Directly invoking kfree(path) leaves dangling pointers in the hlist. A subsequent call to icc_get() or icc_set_bw() will traverse or modify these corrupted lists, triggering a slab use afterfree. KASAN report showing the vulnerability when reproducing via debugfs: BUG: KASAN: slab-use-after-free in path_find+0x6f8/0xcfc Write of size 8 at addr fff000000d43f748 by task sh/1 ... Call trace: kasan_report+0xac/0xfc path_find+0x6f8/0xcfc icc_get+0x148/0x380 icc_get_set+0xf8/0x2d0 ... Freed by task 1: kfree+0x1a0/0x4a4 icc_get+0x2cc/0x380 icc_get_set+0xf8/0x2d0 Fix this by replacing kfree(path) with the proper teardown function, icc_put(path), which safely removes the requests from the req_list using hlist_del() and drops the provider usage references before freeing the memory. Additionally, in icc_get(), ensure that the icc_lock mutex is released prior to calling icc_put(path) to avoid a deadlock, as icc_put() internally acquires the same lock.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-81008

EUVD

EUVD-2026-76331

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's interconnect subsystem. It occurs when memory allocation fails during path name creation, leading to improper cleanup. The error handling path frees memory without removing references from linked lists, causing dangling pointers. Subsequent operations then access freed memory, triggering a slab use-after-free error.

Detection Guidance

This vulnerability is specific to the Linux kernel's interconnect subsystem and requires kernel debugging tools to detect. Enable KASAN (Kernel Address Sanitizer) in your kernel configuration and look for slab-use-after-free errors in dmesg or kernel logs. Check for crashes or warnings in interconnect-related operations via debugfs.

Impact Analysis

This vulnerability could allow an attacker with local access to cause system crashes or execute arbitrary code with kernel privileges. It may lead to denial-of-service conditions or privilege escalation on affected Linux systems using the interconnect subsystem.

Mitigation Strategies

Apply the kernel patch that replaces kfree(path) with icc_put(path) in the interconnect subsystem. Ensure the fix includes proper teardown of linked lists and avoids deadlocks by releasing icc_lock before calling icc_put. Update to a patched kernel version if available.

Hi! I’m here to help you understand CVE-2026-81008. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70