{"id":15187,"date":"2026-09-04T19:02:29","date_gmt":"2026-09-04T11:02:29","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-64188"},"modified":"2026-09-04T19:02:29","modified_gmt":"2026-09-04T11:02:29","slug":"cve-2026-64188","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-64188","title":{"rendered":"CVE-2026-64188 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qualcomm: rmnet:"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()<\/p>\n<p>rmnet_dellink() removes the endpoint from the hash table with<br \/>\nhlist_del_init_rcu() and then immediately frees it with kfree(). However,<br \/>\nRCU readers on the receive path (rmnet_rx_handler -&gt;<br \/>\n__rmnet_map_ingress_handler) may still hold a reference to the endpoint and<br \/>\ndereference ep-&gt;egress_dev after the memory has been freed. The endpoint is<br \/>\na kmalloc-32 object, and the stale read at offset 8 corresponds to the<br \/>\negress_dev pointer.<\/p>\n<p>  BUG: unable to handle page fault for address: ffffffffde942eef<br \/>\n  Oops: 0002 [#1] SMP NOPTI<br \/>\n  CPU: 1 UID: 0 PID: 137 Comm: poc_write Not tainted 7.0.0+ #4 PREEMPTLAZY<br \/>\n  RIP: 0010:rmnet_vnd_rx_fixup (rmnet_vnd.c:27)<br \/>\n  Call Trace:<\/p>\n<p>   __rmnet_map_ingress_handler (rmnet_handlers.c:48 rmnet_handlers.c:101)<br \/>\n   rmnet_rx_handler (rmnet_handlers.c:129 rmnet_handlers.c:235)<br \/>\n   __netif_receive_skb_core.constprop.0 (net\/core\/dev.c:6096)<br \/>\n   __netif_receive_skb_one_core (net\/core\/dev.c:6208)<br \/>\n   netif_receive_skb (net\/core\/dev.c:6467)<br \/>\n   tun_get_user (drivers\/net\/tun.c:1955)<br \/>\n   tun_chr_write_iter (drivers\/net\/tun.c:2003)<br \/>\n   vfs_write (fs\/read_write.c:688)<br \/>\n   ksys_write (fs\/read_write.c:740)<\/p>\n<p>Add an rcu_head field to struct rmnet_endpoint and replace kfree() with<br \/>\nkfree_rcu() so the endpoint memory remains valid through the RCU grace<br \/>\nperiod. Also remove the rmnet_vnd_dellink() call and inline only the<br \/>\nnr_rmnet_devs decrement, since rmnet_vnd_dellink() would set<br \/>\nep-&gt;egress_dev to NULL during the grace period, creating a data race<br \/>\nwith lockless readers.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()<\/p>\n<p>rmnet_dellink() removes the endpoint from the hash table with<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15187","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15187","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15187"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15187"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15187"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}