PT-2026-68122 · Linux · Linux Kernel
CVE-2026-64582
·
Published
2026-08-05
·
Updated
2026-08-09
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A use-after-free issue exists in the RDMA/rxe component. The
rxe mmap() function removes a rxe mmap info structure from the pending mmaps list and releases the pending lock while the structure's reference count is still 1. This allows a concurrent DESTROY CQ ioctl on another CPU to trigger rxe mmap release(), which calls vfree() on ip->obj and kfree() on the rxe mmap info structure while remap vmalloc range partial() is still walking Page Table Entries (PTEs) without a lock.This race condition can lead to two outcomes:
- A kernel crash occurring when
vmalloc to page()returns NULL, resulting in a general protection fault invalidate page before insert(). - A page-level use-after-free where a user Virtual Memory Area (VMA) holds a PTE to a freed page that may be reallocated by
vmalloc.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux Kernel