CVE-2026-64188 - Vulnerability Details

- net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()

Description

In the Linux kernel, the following vulnerability has been resolved:

net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()

rmnet_dellink() removes the endpoint from the hash table with
hlist_del_init_rcu() and then immediately frees it with kfree(). However,
RCU readers on the receive path (rmnet_rx_handler ->
__rmnet_map_ingress_handler) may still hold a reference to the endpoint and
dereference ep->egress_dev after the memory has been freed. The endpoint is
a kmalloc-32 object, and the stale read at offset 8 corresponds to the
egress_dev pointer.

BUG: unable to handle page fault for address: ffffffffde942eef
Oops: 0002 [#1] SMP NOPTI
CPU: 1 UID: 0 PID: 137 Comm: poc_write Not tainted 7.0.0+ #4 PREEMPTLAZY
RIP: 0010:rmnet_vnd_rx_fixup (rmnet_vnd.c:27)
Call Trace:
<TASK>
__rmnet_map_ingress_handler (rmnet_handlers.c:48 rmnet_handlers.c:101)
rmnet_rx_handler (rmnet_handlers.c:129 rmnet_handlers.c:235)
__netif_receive_skb_core.constprop.0 (net/core/dev.c:6096)
__netif_receive_skb_one_core (net/core/dev.c:6208)
netif_receive_skb (net/core/dev.c:6467)
tun_get_user (drivers/net/tun.c:1955)
tun_chr_write_iter (drivers/net/tun.c:2003)
vfs_write (fs/read_write.c:688)
ksys_write (fs/read_write.c:740)
</TASK>

Add an rcu_head field to struct rmnet_endpoint and replace kfree() with
kfree_rcu() so the endpoint memory remains valid through the RCU grace
period. Also remove the rmnet_vnd_dellink() call and inline only the
nr_rmnet_devs decrement, since rmnet_vnd_dellink() would set
ep->egress_dev to NULL during the grace period, creating a data race
with lockless readers.

Published: 2026-07-20

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The defect is a use‑after‑free in the Qualcomm RMnet driver. When rmnet_dellink() removes an endpoint from the hash table it immediately frees the object with kfree(). RCU readers on the receive path can still hold a reference to the endpoint and dereference ep->egress_dev after the memory has been freed, causing a kernel fault and potentially a system crash. The weakness involves improper handling of freed memory (CWE‑825).

Affected Systems

This issue affects the Linux kernel RMnet driver employed in Qualcomm devices, including virtualized networking and mobile modem interfaces. All kernel releases that contain the unpatched RMnet code before the patch (commit a1078ae8) are vulnerable. The vendor is Linux, and there are no other listed products.

Risk and Exploitability

The EPSS score is less than 1 % and the vulnerability does not appear in CISA’s KEV catalog, indicating limited current exploitation activity. The CVSS score of 7.8 indicates a high severity. Nevertheless, the flaw can lead to a critical system crash. Based on the description, it is inferred that an attacker could trigger the bug by sending crafted packets to an enabled RMnet interface; the exploitation does not explicitly require elevated privileges, so local or remote attackers may target the interface depending on network exposure. The potential impact is high due to loss of availability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ceed73a2cf4aff2921802aa3d21d45280677547d`	affected	< c4e676c3505c5058922dc1a6f1ded795f6758135
`ceed73a2cf4aff2921802aa3d21d45280677547d`	affected	< 9918698cf3aee4032e12bb42fd5a951dc465339b
`ceed73a2cf4aff2921802aa3d21d45280677547d`	affected	< 310b93246bfec7d4452507e0c15477377ed9f025
`ceed73a2cf4aff2921802aa3d21d45280677547d`	affected	< 1078ae8175777e80c9637996fb4a46c55f0ce576
`ceed73a2cf4aff2921802aa3d21d45280677547d`	affected	< 41e06fcc5df0774d212e70c5b503fc769492bce3
`ceed73a2cf4aff2921802aa3d21d45280677547d`	affected	< 8b17adf6d4fb6bf61fa4c3f58366a7c082799a71
`ceed73a2cf4aff2921802aa3d21d45280677547d`	affected	< f193e38cb257d033060b63f1cfd94af076b3a2ab
`ceed73a2cf4aff2921802aa3d21d45280677547d`	affected	< d00c953a8f69921f484b629801766da68f27f658

Linux

affected

Version	Status	Constraints
`4.14`	affected	—
`0`	unaffected	< 4.14
`5.10.260`	unaffected	≤ 5.10.*
`5.15.211`	unaffected	≤ 5.15.*
`6.1.177`	unaffected	≤ 6.1.*
`6.6.144`	unaffected	≤ 6.6.*
`6.12.95`	unaffected	≤ 6.12.*
`6.18.37`	unaffected	≤ 6.18.*
`7.0.14`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[ceed73a2cf4aff2921802aa3d21d45280677547d,c4e676c3505c5058922dc1a6f1ded795f6758135)`	affected	code_commit	—
`[ceed73a2cf4aff2921802aa3d21d45280677547d,9918698cf3aee4032e12bb42fd5a951dc465339b)`	affected	code_commit	—
`[ceed73a2cf4aff2921802aa3d21d45280677547d,310b93246bfec7d4452507e0c15477377ed9f025)`	affected	code_commit	—
`[ceed73a2cf4aff2921802aa3d21d45280677547d,1078ae8175777e80c9637996fb4a46c55f0ce576)`	affected	code_commit	—
`[ceed73a2cf4aff2921802aa3d21d45280677547d,41e06fcc5df0774d212e70c5b503fc769492bce3)`	affected	code_commit	—
`[ceed73a2cf4aff2921802aa3d21d45280677547d,8b17adf6d4fb6bf61fa4c3f58366a7c082799a71)`	affected	code_commit	—
`[ceed73a2cf4aff2921802aa3d21d45280677547d,f193e38cb257d033060b63f1cfd94af076b3a2ab)`	affected	code_commit	—
`[ceed73a2cf4aff2921802aa3d21d45280677547d,d00c953a8f69921f484b629801766da68f27f658)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.14`	affected	semver	—
`[0,4.14)`	unaffected	semver	—
`[5.10.260,5.11.0)`	unaffected	semver	—
`[5.15.211,5.16.0)`	unaffected	semver	—
`[6.1.177,6.2.0)`	unaffected	semver	—
`[6.6.144,6.7.0)`	unaffected	semver	—
`[6.12.95,6.13.0)`	unaffected	semver	—
`[6.18.37,6.19.0)`	unaffected	semver	—
`[7.0.14,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the RMnet RCU fix introduced by commit a1078ae8.
Reboot the system to load the patched kernel.
If an updated kernel is not yet available, disable or block the RMnet interface to prevent traffic that could trigger the fault.

Generated by OpenCVE AI on August 3, 2026 at 01:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4700-1	linux-6.1 security update
Debian DLA	DLA-4717-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00117.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1078ae8175777e80c9637996fb4a46c55f0ce576
https://git.kernel.org/stable/c/310b93246bfec7d4452507e0c15477377ed9f025
https://git.kernel.org/stable/c/41e06fcc5df0774d212e70c5b503fc769492bce3
https://git.kernel.org/stable/c/8b17adf6d4fb6bf61fa4c3f58366a7c082799a71
https://git.kernel.org/stable/c/9918698cf3aee4032e12bb42fd5a951dc465339b
https://git.kernel.org/stable/c/c4e676c3505c5058922dc1a6f1ded795f6758135
https://git.kernel.org/stable/c/d00c953a8f69921f484b629801766da68f27f658
https://git.kernel.org/stable/c/f193e38cb257d033060b63f1cfd94af076b3a2ab
https://lore.kernel.org/linux-cve-announce/2026072051-CVE-2026-64188-ce95@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64188
https://www.cve.org/CVERecord?id=CVE-2026-64188

History

Mon, 27 Jul 2026 05:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Tue, 21 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026072051-CVE-2026-64188-ce95@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64188 https://www.cve.org/CVERecord?id=CVE-2026-64188

Mon, 20 Jul 2026 16:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() rmnet_dellink() removes the endpoint from the hash table with hlist_del_init_rcu() and then immediately frees it with kfree(). However, RCU readers on the receive path (rmnet_rx_handler -> __rmnet_map_ingress_handler) may still hold a reference to the endpoint and dereference ep->egress_dev after the memory has been freed. The endpoint is a kmalloc-32 object, and the stale read at offset 8 corresponds to the egress_dev pointer. BUG: unable to handle page fault for address: ffffffffde942eef Oops: 0002 [#1] SMP NOPTI CPU: 1 UID: 0 PID: 137 Comm: poc_write Not tainted 7.0.0+ #4 PREEMPTLAZY RIP: 0010:rmnet_vnd_rx_fixup (rmnet_vnd.c:27) Call Trace: <TASK> __rmnet_map_ingress_handler (rmnet_handlers.c:48 rmnet_handlers.c:101) rmnet_rx_handler (rmnet_handlers.c:129 rmnet_handlers.c:235) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6096) __netif_receive_skb_one_core (net/core/dev.c:6208) netif_receive_skb (net/core/dev.c:6467) tun_get_user (drivers/net/tun.c:1955) tun_chr_write_iter (drivers/net/tun.c:2003) vfs_write (fs/read_write.c:688) ksys_write (fs/read_write.c:740) </TASK> Add an rcu_head field to struct rmnet_endpoint and replace kfree() with kfree_rcu() so the endpoint memory remains valid through the RCU grace period. Also remove the rmnet_vnd_dellink() call and inline only the nr_rmnet_devs decrement, since rmnet_vnd_dellink() would set ep->egress_dev to NULL during the grace period, creating a data race with lockless readers.
Title		net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1078ae8175777e80c9637996fb4a46c55f0ce576 https://git.kernel.org/stable/c/310b93246bfec7d4452507e0c15477377ed9f025 https://git.kernel.org/stable/c/41e06fcc5df0774d212e70c5b503fc769492bce3 https://git.kernel.org/stable/c/8b17adf6d4fb6bf61fa4c3f58366a7c082799a71 https://git.kernel.org/stable/c/9918698cf3aee4032e12bb42fd5a951dc465339b https://git.kernel.org/stable/c/c4e676c3505c5058922dc1a6f1ded795f6758135 https://git.kernel.org/stable/c/d00c953a8f69921f484b629801766da68f27f658 https://git.kernel.org/stable/c/f193e38cb257d033060b63f1cfd94af076b3a2ab

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-20T16:27:47.216Z

Updated: 2026-08-05T12:39:57.703Z

Reserved: 2026-07-19T07:54:57.040Z

Link: CVE-2026-64188

Vulnrichment

No data.

NVD

No data.

Redhat

Severity :

Publid Date: 2026-07-20T00:00:00Z

Links: CVE-2026-64188 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-03T01:30:16Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object