{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-81008", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.812Z", "datePublished": "2026-09-11T19:42:59.405Z", "dateUpdated": "2026-09-13T06:29:12.294Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-13T06:29:12.294Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninterconnect: Fix use after free in icc_get() and of_icc_get_by_index()\n\nIn of_icc_get_by_index() and icc_get(), if the dynamic allocation for\npath->name fails via kasprintf(), the error handling path directly\ncalls kfree(path) to free the path object and returns an error.\n\nHowever, prior to this point, path_find() calls path_init(), which\nalready links the path's requests into the req_list of the respective\ninterconnect nodes via hlist_add_head(). Directly invoking kfree(path)\nleaves dangling pointers in the hlist. A subsequent call to icc_get()\nor icc_set_bw() will traverse or modify these corrupted lists, triggering\na slab use afterfree.\n\nKASAN report showing the vulnerability when reproducing via debugfs:\n\n BUG: KASAN: slab-use-after-free in path_find+0x6f8/0xcfc\n Write of size 8 at addr fff000000d43f748 by task sh/1\n ...\n Call trace:\n kasan_report+0xac/0xfc\n path_find+0x6f8/0xcfc\n icc_get+0x148/0x380\n icc_get_set+0xf8/0x2d0\n ...\n Freed by task 1:\n kfree+0x1a0/0x4a4\n icc_get+0x2cc/0x380\n icc_get_set+0xf8/0x2d0\n\nFix this by replacing kfree(path) with the proper teardown function,\nicc_put(path), which safely removes the requests from the req_list using\nhlist_del() and drops the provider usage references before freeing the\nmemory.\n\nAdditionally, in icc_get(), ensure that the icc_lock mutex is released\nprior to calling icc_put(path) to avoid a deadlock, as icc_put()\ninternally acquires the same lock."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The interconnect core is an on-chip SoC bandwidth API. of_icc_get_by_index() runs from local consumer-driver probe (Qualcomm GPU, venus/camera, UFS, USB, OPP on Android/embedded) and icc_get() from the optional debugfs test client; no network or adjacent protocol handler reaches this code.\nAC:L - Once kasprintf() fails after path_init() has linked path->reqs into node req_lists, the dangling hlist pointers persist and the next icc_set_bw()/path_find() is a deterministic UAF, not a race. A local attacker can force the GFP_KERNEL name allocation to fail with memory pressure and retry via driver rebind, module load, or deferred probe.\nPR:L - After the error path plants dangling req_list entries, an ordinary local/Android user triggers the UAF through icc_set_bw() via V4L2, DRM render nodes, or block I/O on already-probed consumers that share interconnect nodes. of_icc_get() itself runs from consumer probe/rebind whose privilege gating is ambiguous, so Low applies.\nUI:N - The attacker induces memory pressure and device activity (or a rebind/probe) from their own process. No separate victim action such as mounting a filesystem or opening a file is required.\nS:U - The UAF corrupts kernel heap objects and interconnect provider state in the host kernel. This is standard kernel privilege escalation and does not cross a VM, IOMMU, or sandbox security boundary.\nC:H - This is a slab use-after-free of struct icc_path whose embedded icc_req hlist nodes remain on node->req_list. aggregate_requests() and the interconnect debugfs summary read enabled/tag/avg_bw/peak_bw and r->dev from the freed object, so heap reuse yields an arbitrary kernel read primitive.\nI:H - path_find() hlist_add_head() performs an 8-byte write through the dangling first pointer into freed memory, and a sprayed next pointer hijacks later list walks. apply_constraints() then programs attacker-controlled bandwidth into interconnect hardware, giving a UAF write/control-flow primitive.\nA:H - Walking LIST_POISON or a dangling req_node in aggregate_requests() or path_find() oopses or panics the kernel. Any use-after-free is High availability impact even when not fully turned into code execution."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/interconnect/core.c"], "versions": [{"version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07", "lessThan": "a4e9aa7907ade87d1d96853d14e05dcf682f8363", "status": "affected", "versionType": "git"}, {"version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07", "lessThan": "db8147c5d5ad2cfa21c2be566f95981b41b05de6", "status": "affected", "versionType": "git"}, {"version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07", "lessThan": "d715d19cfcfe99f361adb05cefc143a95d400b87", "status": "affected", "versionType": "git"}, {"version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07", "lessThan": "25c7e242aca084fdc1098248194032317dca625d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/interconnect/core.c"], "versions": [{"version": "5.6", "status": "affected"}, {"version": "0", "lessThan": "5.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a4e9aa7907ade87d1d96853d14e05dcf682f8363"}, {"url": "https://git.kernel.org/stable/c/db8147c5d5ad2cfa21c2be566f95981b41b05de6"}, {"url": "https://git.kernel.org/stable/c/d715d19cfcfe99f361adb05cefc143a95d400b87"}, {"url": "https://git.kernel.org/stable/c/25c7e242aca084fdc1098248194032317dca625d"}], "title": "interconnect: Fix use after free in icc_get() and of_icc_get_by_index()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/interconnect/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a4e9aa7907ade87d1d96853d14e05dcf682f8363", "status": "affected", "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07", "versionType": "git"}, {"lessThan": "db8147c5d5ad2cfa21c2be566f95981b41b05de6", "status": "affected", "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07", "versionType": "git"}, {"lessThan": "d715d19cfcfe99f361adb05cefc143a95d400b87", "status": "affected", "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07", "versionType": "git"}, {"lessThan": "25c7e242aca084fdc1098248194032317dca625d", "status": "affected", "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/interconnect/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.6"}, {"lessThan": "5.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninterconnect: Fix use after free in icc_get() and of_icc_get_by_index()\n\nIn of_icc_get_by_index() and icc_get(), if the dynamic allocation for\npath->name fails via kasprintf(), the error handling path directly\ncalls kfree(path) to free the path object and returns an error.\n\nHowever, prior to this point, path_find() calls path_init(), which\nalready links the path's requests into the req_list of the respective\ninterconnect nodes via hlist_add_head(). Directly invoking kfree(path)\nleaves dangling pointers in the hlist. A subsequent call to icc_get()\nor icc_set_bw() will traverse or modify these corrupted lists, triggering\na slab use afterfree.\n\nKASAN report showing the vulnerability when reproducing via debugfs:\n\n BUG: KASAN: slab-use-after-free in path_find+0x6f8/0xcfc\n Write of size 8 at addr fff000000d43f748 by task sh/1\n ...\n Call trace:\n kasan_report+0xac/0xfc\n path_find+0x6f8/0xcfc\n icc_get+0x148/0x380\n icc_get_set+0xf8/0x2d0\n ...\n Freed by task 1:\n kfree+0x1a0/0x4a4\n icc_get+0x2cc/0x380\n icc_get_set+0xf8/0x2d0\n\nFix this by replacing kfree(path) with the proper teardown function,\nicc_put(path), which safely removes the requests from the req_list using\nhlist_del() and drops the provider usage references before freeing the\nmemory.\n\nAdditionally, in icc_get(), ensure that the icc_lock mutex is released\nprior to calling icc_put(path) to avoid a deadlock, as icc_put()\ninternally acquires the same lock."}], "id": "CVE-2026-81008", "lastModified": "2026-09-13T07:17:07.517", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-11T20:19:09.560", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/25c7e242aca084fdc1098248194032317dca625d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a4e9aa7907ade87d1d96853d14e05dcf682f8363"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d715d19cfcfe99f361adb05cefc143a95d400b87"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/db8147c5d5ad2cfa21c2be566f95981b41b05de6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel interconnect: Use-after-free vulnerability can lead to system instability", "id": "2532455", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532455"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's interconnect subsystem. When a dynamic memory allocation fails during path initialization, an object is prematurely freed while still being referenced in internal lists. This creates dangling pointers, which can be later accessed or modified. This use-after-free vulnerability can lead to system instability or a denial of service."], "name": "CVE-2026-81008", "public_date": "2026-09-11T19:42:59Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-81008\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-81008\nhttps://git.kernel.org/stable/c/25c7e242aca084fdc1098248194032317dca625d\nhttps://git.kernel.org/stable/c/a4e9aa7907ade87d1d96853d14e05dcf682f8363\nhttps://git.kernel.org/stable/c/d715d19cfcfe99f361adb05cefc143a95d400b87\nhttps://git.kernel.org/stable/c/db8147c5d5ad2cfa21c2be566f95981b41b05de6"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3791163602f7140011a8dc1691cfe6ec0cb1ef07,a4e9aa7907ade87d1d96853d14e05dcf682f8363)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3791163602f7140011a8dc1691cfe6ec0cb1ef07,db8147c5d5ad2cfa21c2be566f95981b41b05de6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3791163602f7140011a8dc1691cfe6ec0cb1ef07,d715d19cfcfe99f361adb05cefc143a95d400b87)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3791163602f7140011a8dc1691cfe6ec0cb1ef07,25c7e242aca084fdc1098248194032317dca625d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.109,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.50,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.4,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-13T00:15:03.055721+00:00", "updated": "2026-09-13T09:00:13.564908+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}