CVE-2026-64073: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64073 Overview

CVE-2026-64073 is a use-after-free vulnerability in the Linux kernel's irq_work subsystem when built with PREEMPT_RT. The flaw resides in irq_work_single(), which continues to dereference the @work structure after clearing the BUSY flag via atomic_cmpxchg(). A concurrent irq_work_sync() caller on another CPU can observe BUSY==0 immediately, return, and free the work object before the remaining irq_work_is_hard() and rcuwait_wake_up() accesses complete. The upstream fix wraps run_irq_workd() in guard(rcu)() and adds synchronize_rcu() after rcuwait_wait_event() in irq_work_sync().

Critical Impact
A local, low-privileged attacker on a PREEMPT_RT Linux kernel can trigger a race condition in irq_work_single() leading to memory corruption with high confidentiality, integrity, and availability impact.

Affected Products

Linux kernel builds with CONFIG_PREEMPT_RT enabled
Stable kernel branches referenced in the six upstream fix commits
Real-time Linux distributions and derivatives shipping the affected irq_work code path

Discovery Timeline

2026-07-19 - CVE-2026-64073 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64073

Vulnerability Analysis

The vulnerability is a use-after-free triggered by a race condition in the kernel's deferred work mechanism. On PREEMPT_RT, non-HARD irq_work callbacks execute in per-CPU kthreads through run_irq_workd(), and irq_work_sync() relies on rcuwait() to block until the BUSY flag reaches zero.

After irq_work_single() clears the BUSY bit using atomic_cmpxchg(), the function still dereferences the @work pointer to evaluate irq_work_is_hard() and to call rcuwait_wake_up(). This creates a narrow window where another CPU running irq_work_sync() can see BUSY==0, exit the wait, and release the underlying memory before the executing CPU finishes touching it.

Root Cause

The root cause is missing synchronization between the state transition that signals completion and the residual pointer dereferences that follow it. atomic_cmpxchg() publishes visibility of BUSY==0 to all CPUs, but there is no RCU read-side critical section or grace period protecting the trailing accesses to @work. Callers of irq_work_sync() therefore have no guarantee that the kthread has finished with the object before they free it.

Attack Vector

Exploitation requires local access with the ability to schedule and free irq_work structures on a PREEMPT_RT kernel. An attacker races an irq_work_sync() call on one CPU against the tail of irq_work_single() on another, freeing the work object at the exact moment rcuwait_wake_up() still holds a reference. Successful races yield a classic use-after-free primitive that can be shaped into kernel memory corruption, information disclosure, or privilege escalation. No user interaction or network access is required.

No public proof-of-concept exploit is currently available. The upstream patches are tracked across six commits on git.kernel.org, including commit 18c0456e and commit 2dc79362.

Detection Methods for CVE-2026-64073

Indicators of Compromise

Unexplained kernel oops or panic messages referencing irq_work_single, run_irq_workd, or rcuwait_wake_up in dmesg and journalctl -k output
KASAN use-after-free reports naming the irq_work structure or its containing allocation
Unexpected process crashes or kernel task hangs on hosts running a PREEMPT_RT kernel

Detection Strategies

Enable CONFIG_KASAN on test systems to surface the use-after-free at the moment of occurrence
Correlate kernel crash telemetry with running kernel version and PREEMPT_RT configuration to identify vulnerable hosts
Alert on repeated kernel warnings or panics on real-time Linux workloads, which are typically stable under normal operation

Monitoring Recommendations

Ship kernel logs to a centralized data lake and query for irq_work stack frames in crash traces
Track kernel package versions across the fleet and flag any host still running a pre-patch PREEMPT_RT build
Monitor for unusual local process behavior on real-time hosts, including repeated attempts to trigger high-frequency deferred work

How to Mitigate CVE-2026-64073

Immediate Actions Required

Inventory all Linux systems built with CONFIG_PREEMPT_RT and prioritize them for patching
Apply the vendor-supplied stable kernel update that includes the guard(rcu)() wrapper in run_irq_workd() and synchronize_rcu() in irq_work_sync()
Restrict local access on affected hosts until the patched kernel is deployed and rebooted

Patch Information

The fix is available in the mainline and stable Linux kernel trees through the following commits: 18c0456e, 2dc79362, 684a7818, 81b58278, 91840be8, and eef4f71b. Rebuild or install the updated kernel package from the affected distribution and reboot to activate the fix.

Workarounds

If patching is not immediately possible, deploy kernels without CONFIG_PREEMPT_RT where the workload permits, since the race is specific to that configuration
Enforce strict local access controls and reduce the number of unprivileged interactive users on real-time hosts
Use kernel hardening options such as KASAN in staging to identify residual code paths that touch freed irq_work objects before production rollout

bash

# Verify kernel version and PREEMPT_RT status on a Linux host
uname -a
grep -E 'PREEMPT( |_RT)' /proc/version

# Confirm the running kernel package after patching
rpm -q kernel-rt   # RHEL / SUSE real-time variants
dpkg -l | grep linux-image-rt   # Debian / Ubuntu real-time variants