CVE-2026-64188: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
In the Linux kernel, the following vulnerability has been resolved:
net: qualcomm: rmnet: fix endpoint use-after-free in rmnetdellink()
rmnetdellink() removes the endpoint from the hash table with hlistdelinitrcu() and then immediately frees it with kfree(). However, RCU readers on the receive path (rmnetrxhandler -> rmnetmapingresshandler) may still hold a reference to the endpoint and dereference ep->egressdev after the memory has been freed. The endpoint is a kmalloc-32 object, and the stale read at offset 8 corresponds to the egressdev pointer.
BUG: unable to handle page fault for address: ffffffffde942eef Oops: 0002 [#1] SMP NOPTI CPU: 1 UID: 0 PID: 137 Comm: pocwrite Not tainted 7.0.0+ #4 PREEMPTLAZY RIP: 0010:rmnetvndrxfixup (rmnetvnd.c:27) Call Trace: <TASK> rmnetmapingresshandler (rmnethandlers.c:48 rmnethandlers.c:101) rmnetrxhandler (rmnethandlers.c:129 rmnethandlers.c:235) netifreceiveskbcore.constprop.0 (net/core/dev.c:6096) netifreceiveskbonecore (net/core/dev.c:6208) netifreceiveskb (net/core/dev.c:6467) tungetuser (drivers/net/tun.c:1955) tunchrwriteiter (drivers/net/tun.c:2003) vfswrite (fs/readwrite.c:688) ksyswrite (fs/readwrite.c:740) </TASK>
Add an rcuhead field to struct rmnetendpoint and replace kfree() with kfreercu() so the endpoint memory remains valid through the RCU grace period. Also remove the rmnetvnddellink() call and inline only the nrrmnetdevs decrement, since rmnetvnddellink() would set ep->egressdev to NULL during the grace period, creating a data race with lockless readers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.150.1-1 - Configuration
In rmnet_dellink(), replace the direct kfree() of the endpoint memory with kfree_rcu() so the endpoint remains valid for RCU grace periods and avoids the use-after-free while RCU readers still hold references (per the described rmnet_dellink()/rmnet_vnd.c race: kfree_rcu keeps ep valid through grace period).
Linux kernel rmnet_dellink() / rmnet_vnd_dellink() RCU free method for endpoint memory (kfree vs kfree_rcu) = kfree_rcu() - Configuration
Modify struct rmnet_endpoint to add an rcu_head field to support freeing via kfree_rcu() (as described: 'Add an rcu_head field to struct rmnet_endpoint').
Linux kernel rmnet_endpoint struct struct rmnet_endpoint field = Add rcu_head field - Configuration
Remove the rmnet_vnd_dellink() call from rmnet_dellink(), and inline only the rmnet_vnd_dellink() functionality as indicated by 'Also remove the rmnet_vnd_dellink() call and inline only the' (as specified in the text).
Linux kernel rmnet_dellink() call flow rmnet_vnd_dellink() invocation = Remove rmnet_vnd_dellink() call
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64188?
CVE-2026-64188 has a risk rating of 53, indicating a moderate severity level.
How do I fix CVE-2026-64188?
To fix CVE-2026-64188, update your Linux kernel to the latest version that includes the patch for the use-after-free vulnerability.
What type of vulnerability is CVE-2026-64188?
CVE-2026-64188 is classified as a use-after-free vulnerability in the Linux kernel.
What component is affected by CVE-2026-64188?
CVE-2026-64188 affects the Qualcomm rmnet implementation in the Linux kernel.
When was CVE-2026-64188 published?
CVE-2026-64188 was published on July 20, 2026.