CVE-2026-64073

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the irq work single() function when using PREEMPT RT. In this configuration, non-HARD irq work is executed in per-CPU kthreads through run irq workd(), and irq work sync() utilizes rcuwait() to wait for the BUSY flag to reach 0. A race condition occurs when irq work single() clears the BUSY flag via atomic cmpxchg() but continues to dereference the @work variable for irq work is hard() and rcuwait wake up(). If a caller on another CPU invokes irq work sync() and observes BUSY==0 immediately, it may return and free the work before the initial accesses are completed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.