CVE-2026-68332

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the airoha ppe deinit() function. The function replaces the NPU pointer with NULL using rcu replace pointer() but fails to wait for existing RCU readers to exit before calling ppe deinit() and airoha npu put(). This occurs because a matching barrier was omitted when transitioning from rcu read lock()/rcu dereference() to rcu replace pointer(). Consequently, if a reader in an RCU read-side critical section still holds a reference to the NPU when it is freed, a use-after-free condition occurs. RCU (Read-Copy-Update) is a synchronization mechanism that allows multiple readers to access data while it is being updated.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.