CVE-2026-68332: net: airoha: Fix potential use-after-free in airoha_ppe_deinit()
In the Linux kernel, the following vulnerability has been resolved:
net: airoha: Fix potential use-after-free in airohappedeinit()
airohappedeinit() replaces the NPU pointer with NULL via rcureplacepointer() but does not wait for existing RCU readers to exit before calling ppedeinit() and airohanpuput(). This can cause a use-after-free if a reader in an RCU read-side critical section still holds a reference to the NPU when it is freed.
The init path (airohappeinit) already calls synchronizercu() after rcuassignpointer(), but the deinit path introduced in commit 6abcf751bc08 ("net: airoha: Fix schedule while atomic in airohappedeinit()") omitted the matching barrier when switching from rcureadlock()/rcudereference() to rcureplacepointer().
Add synchronizercu() before ppedeinit() to ensure all existing RCU readers have completed before the NPU resources are released.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the deinit path (airoha_ppe_deinit()) to invoke synchronize_rcu() before calling ppe_deinit() / airoha_npu_put() so that all RCU readers have exited prior to releasing NPU resources. (Use case: match the init path that already calls synchronize_rcu(); ensure the barrier is present when switching the NPU pointer to NULL via rcu_replace_pointer()/rcu_assign_pointer.)
Linux kernel (net: airoha: airoha_ppe_deinit) RCU synchronization ordering (synchronize_rcu before ppe_deinit) = Call synchronize_rcu() before releasing NPU resources in airoha_ppe_deinit() so RCU readers complete before ppe_deinit() and airoha_npu_put() free resources
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68332?
The severity of CVE-2026-68332 is rated at risk level 44, indicating a significant security concern.
How do I fix CVE-2026-68332?
To fix CVE-2026-68332, apply the latest patches or updates recommended for the Linux kernel that address this use-after-free vulnerability.
What type of vulnerability is CVE-2026-68332?
CVE-2026-68332 is categorized as a 'Use After Free' vulnerability in the Linux kernel.
What impact does CVE-2026-68332 have on system security?
CVE-2026-68332 may lead to potential system crashes or execution of arbitrary code due to the improper handling of memory.
In which component of the Linux kernel does CVE-2026-68332 occur?
CVE-2026-68332 occurs in the net: airoha component of the Linux kernel.