{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-81008", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.812Z", "datePublished": "2026-09-11T19:42:59.405Z", "dateUpdated": "2026-09-11T19:42:59.405Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:42:59.405Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninterconnect: Fix use after free in icc_get() and of_icc_get_by_index()\n\nIn of_icc_get_by_index() and icc_get(), if the dynamic allocation for\npath->name fails via kasprintf(), the error handling path directly\ncalls kfree(path) to free the path object and returns an error.\n\nHowever, prior to this point, path_find() calls path_init(), which\nalready links the path's requests into the req_list of the respective\ninterconnect nodes via hlist_add_head(). Directly invoking kfree(path)\nleaves dangling pointers in the hlist. A subsequent call to icc_get()\nor icc_set_bw() will traverse or modify these corrupted lists, triggering\na slab use afterfree.\n\nKASAN report showing the vulnerability when reproducing via debugfs:\n\n BUG: KASAN: slab-use-after-free in path_find+0x6f8/0xcfc\n Write of size 8 at addr fff000000d43f748 by task sh/1\n ...\n Call trace:\n kasan_report+0xac/0xfc\n path_find+0x6f8/0xcfc\n icc_get+0x148/0x380\n icc_get_set+0xf8/0x2d0\n ...\n Freed by task 1:\n kfree+0x1a0/0x4a4\n icc_get+0x2cc/0x380\n icc_get_set+0xf8/0x2d0\n\nFix this by replacing kfree(path) with the proper teardown function,\nicc_put(path), which safely removes the requests from the req_list using\nhlist_del() and drops the provider usage references before freeing the\nmemory.\n\nAdditionally, in icc_get(), ensure that the icc_lock mutex is released\nprior to calling icc_put(path) to avoid a deadlock, as icc_put()\ninternally acquires the same lock."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/interconnect/core.c"], "versions": [{"version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07", "lessThan": "a4e9aa7907ade87d1d96853d14e05dcf682f8363", "status": "affected", "versionType": "git"}, {"version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07", "lessThan": "db8147c5d5ad2cfa21c2be566f95981b41b05de6", "status": "affected", "versionType": "git"}, {"version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07", "lessThan": "d715d19cfcfe99f361adb05cefc143a95d400b87", "status": "affected", "versionType": "git"}, {"version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07", "lessThan": "25c7e242aca084fdc1098248194032317dca625d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/interconnect/core.c"], "versions": [{"version": "5.6", "status": "affected"}, {"version": "0", "lessThan": "5.6", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a4e9aa7907ade87d1d96853d14e05dcf682f8363"}, {"url": "https://git.kernel.org/stable/c/db8147c5d5ad2cfa21c2be566f95981b41b05de6"}, {"url": "https://git.kernel.org/stable/c/d715d19cfcfe99f361adb05cefc143a95d400b87"}, {"url": "https://git.kernel.org/stable/c/25c7e242aca084fdc1098248194032317dca625d"}], "title": "interconnect: Fix use after free in icc_get() and of_icc_get_by_index()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/interconnect/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a4e9aa7907ade87d1d96853d14e05dcf682f8363", "status": "affected", "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07", "versionType": "git"}, {"lessThan": "db8147c5d5ad2cfa21c2be566f95981b41b05de6", "status": "affected", "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07", "versionType": "git"}, {"lessThan": "d715d19cfcfe99f361adb05cefc143a95d400b87", "status": "affected", "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07", "versionType": "git"}, {"lessThan": "25c7e242aca084fdc1098248194032317dca625d", "status": "affected", "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/interconnect/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.6"}, {"lessThan": "5.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninterconnect: Fix use after free in icc_get() and of_icc_get_by_index()\n\nIn of_icc_get_by_index() and icc_get(), if the dynamic allocation for\npath->name fails via kasprintf(), the error handling path directly\ncalls kfree(path) to free the path object and returns an error.\n\nHowever, prior to this point, path_find() calls path_init(), which\nalready links the path's requests into the req_list of the respective\ninterconnect nodes via hlist_add_head(). Directly invoking kfree(path)\nleaves dangling pointers in the hlist. A subsequent call to icc_get()\nor icc_set_bw() will traverse or modify these corrupted lists, triggering\na slab use afterfree.\n\nKASAN report showing the vulnerability when reproducing via debugfs:\n\n BUG: KASAN: slab-use-after-free in path_find+0x6f8/0xcfc\n Write of size 8 at addr fff000000d43f748 by task sh/1\n ...\n Call trace:\n kasan_report+0xac/0xfc\n path_find+0x6f8/0xcfc\n icc_get+0x148/0x380\n icc_get_set+0xf8/0x2d0\n ...\n Freed by task 1:\n kfree+0x1a0/0x4a4\n icc_get+0x2cc/0x380\n icc_get_set+0xf8/0x2d0\n\nFix this by replacing kfree(path) with the proper teardown function,\nicc_put(path), which safely removes the requests from the req_list using\nhlist_del() and drops the provider usage references before freeing the\nmemory.\n\nAdditionally, in icc_get(), ensure that the icc_lock mutex is released\nprior to calling icc_put(path) to avoid a deadlock, as icc_put()\ninternally acquires the same lock."}], "id": "CVE-2026-81008", "lastModified": "2026-09-11T20:19:09.560", "metrics": {}, "published": "2026-09-11T20:19:09.560", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/25c7e242aca084fdc1098248194032317dca625d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a4e9aa7907ade87d1d96853d14e05dcf682f8363"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d715d19cfcfe99f361adb05cefc143a95d400b87"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/db8147c5d5ad2cfa21c2be566f95981b41b05de6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel interconnect: Use-after-free vulnerability can lead to system instability", "id": "2532455", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532455"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's interconnect subsystem. When a dynamic memory allocation fails during path initialization, an object is prematurely freed while still being referenced in internal lists. This creates dangling pointers, which can be later accessed or modified. This use-after-free vulnerability can lead to system instability or a denial of service."], "name": "CVE-2026-81008", "public_date": "2026-09-11T19:42:59Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-81008\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-81008\nhttps://git.kernel.org/stable/c/25c7e242aca084fdc1098248194032317dca625d\nhttps://git.kernel.org/stable/c/a4e9aa7907ade87d1d96853d14e05dcf682f8363\nhttps://git.kernel.org/stable/c/d715d19cfcfe99f361adb05cefc143a95d400b87\nhttps://git.kernel.org/stable/c/db8147c5d5ad2cfa21c2be566f95981b41b05de6"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3791163602f7140011a8dc1691cfe6ec0cb1ef07,a4e9aa7907ade87d1d96853d14e05dcf682f8363)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3791163602f7140011a8dc1691cfe6ec0cb1ef07,db8147c5d5ad2cfa21c2be566f95981b41b05de6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3791163602f7140011a8dc1691cfe6ec0cb1ef07,d715d19cfcfe99f361adb05cefc143a95d400b87)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3791163602f7140011a8dc1691cfe6ec0cb1ef07,25c7e242aca084fdc1098248194032317dca625d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.109,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.50,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.4,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-13T00:15:03.055721+00:00", "updated": "2026-09-13T00:15:03.055752+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}