Use-After-Free Vulnerability in Linux Kernel Qualcomm RMNet

CVE-2026-64188

What is CVE-2026-64188?

A use-after-free vulnerability exists in the Linux kernel's Qualcomm RMNet implementation. This issue arises when the rmnet_dellink() function removes an endpoint from the hash table and frees it while RCU readers may still reference this endpoint, potentially leading to dereferencing invalid memory. The immediate memory deallocation risks stale reads, resulting in possible crashes or undefined behavior. To mitigate this vulnerability, the code should be modified to retain the endpoint memory during the RCU grace period, ensuring safe access for concurrent readers.

References