Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-64188— net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 4.14版本存在安全漏洞，该漏洞源于rmnet_dellink()中端点释放后重用，可能导致RCU读取器在释放端点后引用ep->egress_dev指针。

CVSS 7.8 · High EPSS 0.12% · P2

Possible ATT&CK Techniques 1 AI

T1211 · Exploitation for Stealth

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux ceed73a2cf4aff2921802aa3d21d45280677547d< c4e676c3505c5058922dc1a6f1ded795f6758135 affected
ceed73a2cf4aff2921802aa3d21d45280677547d< 9918698cf3aee4032e12bb42fd5a951dc465339b affected
ceed73a2cf4aff2921802aa3d21d45280677547d< 310b93246bfec7d4452507e0c15477377ed9f025 affected
ceed73a2cf4aff2921802aa3d21d45280677547d< 1078ae8175777e80c9637996fb4a46c55f0ce576 affected
ceed73a2cf4aff2921802aa3d21d45280677547d< 41e06fcc5df0774d212e70c5b503fc769492bce3 affected
ceed73a2cf4aff2921802aa3d21d45280677547d< 8b17adf6d4fb6bf61fa4c3f58366a7c082799a71 affected
ceed73a2cf4aff2921802aa3d21d45280677547d< f193e38cb257d033060b63f1cfd94af076b3a2ab affected
ceed73a2cf4aff2921802aa3d21d45280677547d< d00c953a8f69921f484b629801766da68f27f658 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-64188

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() rmnet_dellink() removes the endpoint from the hash table with hlist_del_init_rcu() and then immediately frees it with kfree(). However, RCU readers on the receive path (rmnet_rx_handler -> __rmnet_map_ingress_handler) may still hold a reference to the endpoint and dereference ep->egress_dev after the memory has been freed. The endpoint is a kmalloc-32 object, and the stale read at offset 8 corresponds to the egress_dev pointer. BUG: unable to handle page fault for address: ffffffffde942eef Oops: 0002 [#1] SMP NOPTI CPU: 1 UID: 0 PID: 137 Comm: poc_write Not tainted 7.0.0+ #4 PREEMPTLAZY RIP: 0010:rmnet_vnd_rx_fixup (rmnet_vnd.c:27) Call Trace: <TASK> __rmnet_map_ingress_handler (rmnet_handlers.c:48 rmnet_handlers.c:101) rmnet_rx_handler (rmnet_handlers.c:129 rmnet_handlers.c:235) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6096) __netif_receive_skb_one_core (net/core/dev.c:6208) netif_receive_skb (net/core/dev.c:6467) tun_get_user (drivers/net/tun.c:1955) tun_chr_write_iter (drivers/net/tun.c:2003) vfs_write (fs/read_write.c:688) ksys_write (fs/read_write.c:740) </TASK> Add an rcu_head field to struct rmnet_endpoint and replace kfree() with kfree_rcu() so the endpoint memory remains valid through the RCU grace period. Also remove the rmnet_vnd_dellink() call and inline only the nr_rmnet_devs decrement, since rmnet_vnd_dellink() would set ep->egress_dev to NULL during the grace period, creating a data race with lockless readers.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 4.14版本存在安全漏洞，该漏洞源于rmnet_dellink()中端点释放后重用，可能导致RCU读取器在释放端点后引用ep->egress_dev指针。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux ceed73a2cf4aff2921802aa3d21d45280677547d ~ c4e676c3505c5058922dc1a6f1ded795f6758135 -
Linux Linux 4.14 -

II. Public POCs for CVE-2026-64188

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64188

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-64188 (6)

Same Patch Batch · Linux · 2026-07-20 · 9 CVEs total

CVE-2026-64206 8.8 HIGH Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
CVE-2026-64189 7.8 HIGH netfilter: ipset: fix race between dump and ip_set_list resize
CVE-2026-64191 7.8 HIGH i2c: stub: Reject I2C block transfers with invalid length
CVE-2026-64187 xfs: fail recovery on a committed log item with no regions
CVE-2026-64190 net: team: fix NULL pointer dereference in team_xmit during mode change
CVE-2026-64192 bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
CVE-2026-64205 i2c: i801: fix hardware state machine corruption in error path
CVE-2026-64207 net/sched: dualpi2: fix GSO backlog accounting

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-64188

No comments yet

Leave a comment