{"id":15053,"date":"2026-09-04T19:02:23","date_gmt":"2026-09-04T11:02:23","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-64073"},"modified":"2026-09-04T19:02:23","modified_gmt":"2026-09-04T11:02:23","slug":"cve-2026-64073","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-64073","title":{"rendered":"CVE-2026-64073 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nirq_work: Fix use-aft"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT<\/p>\n<p>On PREEMPT_RT, non-HARD irq_work runs in per-CPU kthreads via<br \/>\nrun_irq_workd(), so irq_work_sync() uses rcuwait() to wait for BUSY==0.<\/p>\n<p>After irq_work_single() clears BUSY via atomic_cmpxchg(), it still<br \/>\ndereferences @work for irq_work_is_hard() and rcuwait_wake_up().<\/p>\n<p>An irq_work_sync() caller on another CPU that enters after BUSY is cleared<br \/>\ncan observe BUSY==0 immediately, return, and free the work before those<br \/>\naccesses complete \u2014 causing a use-after-free.<\/p>\n<p>Fix this by wrapping run_irq_workd() in guard(rcu)() so that the entire<br \/>\nirq_work_single() execution is within an RCU read-side critical<br \/>\nsection. Then add synchronize_rcu() in irq_work_sync() after<br \/>\nrcuwait_wait_event() to ensure the caller waits for the RCU grace period<br \/>\nbefore returning, preventing premature frees.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT<\/p>\n<p>On PREEMPT_RT, non-HARD irq_work runs in per-CPU kthreads via<br \/>\nrun_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15053","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15053","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15053"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15053"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15053"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}