7.8

CVE-2026-64073

irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT

In the Linux kernel, the following vulnerability has been resolved:

irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT

On PREEMPT_RT, non-HARD irq_work runs in per-CPU kthreads via
run_irq_workd(), so irq_work_sync() uses rcuwait() to wait for BUSY==0.

After irq_work_single() clears BUSY via atomic_cmpxchg(), it still
dereferences @work for irq_work_is_hard() and rcuwait_wake_up().

An irq_work_sync() caller on another CPU that enters after BUSY is cleared
can observe BUSY==0 immediately, return, and free the work before those
accesses complete — causing a use-after-free.

Fix this by wrapping run_irq_workd() in guard(rcu)() so that the entire
irq_work_single() execution is within an RCU read-side critical
section. Then add synchronize_rcu() in irq_work_sync() after
rcuwait_wait_event() to ensure the caller waits for the RCU grace period
before returning, preventing premature frees.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 810979682ccc98dbd83f341c18a2e556c30a7164
Version < 2dc79362302922cb18f35e262712b5e58de65442
Status affected
Version 810979682ccc98dbd83f341c18a2e556c30a7164
Version < eef4f71b46a9929ac33e968538c9dd5d96a02460
Status affected
Version 810979682ccc98dbd83f341c18a2e556c30a7164
Version < 684a78183c54c23e70d1cba320f7fc184604210b
Status affected
Version 810979682ccc98dbd83f341c18a2e556c30a7164
Version < 18c0456ea2615b1a743a6db739c74411c3b42bc6
Status affected
Version 810979682ccc98dbd83f341c18a2e556c30a7164
Version < 81b582784518196eff1050212a046bc29d3a05dd
Status affected
Version 810979682ccc98dbd83f341c18a2e556c30a7164
Version < 91840be8f710370607f949a627e070896faeddb8
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 5.16
Status affected
Version 0
Version < 5.16
Status unaffected
Version <= 6.1.*
Version 6.1.175
Status unaffected
Version <= 6.6.*
Version 6.6.142
Status unaffected
Version <= 6.12.*
Version 6.12.92
Status unaffected
Version <= 6.18.*
Version 6.18.34
Status unaffected
Version <= 7.0.*
Version 7.0.11
Status unaffected
Version <= *
Version 7.1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.13% 0.032
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/2dc79362302922cb18f35e262712b5e58de65442
https://git.kernel.org/stable/c/eef4f71b46a9929ac33e968538c9dd5d96a02460
https://git.kernel.org/stable/c/684a78183c54c23e70d1cba320f7fc184604210b
https://git.kernel.org/stable/c/18c0456ea2615b1a743a6db739c74411c3b42bc6
https://git.kernel.org/stable/c/81b582784518196eff1050212a046bc29d3a05dd
https://git.kernel.org/stable/c/91840be8f710370607f949a627e070896faeddb8