CVE-2026-64118: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64118 Overview

CVE-2026-64118 is a double free vulnerability in the Linux kernel qed Ethernet driver. The flaw resides in qed_cxt_tables_alloc() and is triggered when a Physical Function (PF) or Virtual Function (VF) Connection ID (CID) bitmap allocation fails during driver initialization. On the failure path, qed_cid_map_alloc() frees previously allocated bitmaps, after which qed_cxt_mngr_free() frees them again through qed_cid_map_free().

Critical Impact
A local attacker able to trigger the failing allocation path can corrupt kernel heap metadata, leading to memory corruption, denial of service, or potential local privilege escalation on systems using QLogic FastLinQ NICs.

Affected Products

Linux kernel versions confirmed vulnerable through v7.1-rc3
Linux kernel v6.13-rc1 (flagged by the reporting analysis tool)
Systems using the qed driver for QLogic FastLinQ 4xxxx Ethernet controllers

Discovery Timeline

2026-07-19 - CVE-2026-64118 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64118

Vulnerability Analysis

The defect is a classic double free [CWE-415] in the QLogic qed Ethernet driver initialization sequence. During driver bring-up, qed_cxt_tables_alloc() calls qed_cid_map_alloc() to allocate CID bitmaps for each protocol type across both PFs and VFs. If a later allocation fails after earlier bitmaps have already been created, qed_cid_map_alloc() jumps to the cid_map_fail label and frees the previously allocated bitmaps using bitmap_free().

The caller qed_cxt_tables_alloc() then invokes qed_cxt_mngr_free() as part of its own error unwind. That routine walks the same CID map array and calls qed_cid_map_free() on entries whose pointers were never cleared. The kernel therefore frees the identical bitmap allocations twice.

Root Cause

The root cause is missing pointer nullification after bitmap_free() on the failure path. Because qed_cid_map_alloc() and qed_cxt_mngr_free() share ownership of the same bitmap pointers without a state flag, both free the same memory. The upstream fix sets each CID bitmap pointer to NULL immediately after bitmap_free() so that subsequent cleanup treats the entry as already released.

Attack Vector

Exploitation requires local access and the ability to induce an allocation failure inside qed_cid_map_alloc(). Attack vector is Local with low complexity and no privileges or user interaction required per the CVSS vector. Reaching the vulnerable path in practice requires QLogic FastLinQ hardware or an equivalent device probe sequence. Runtime reproduction was not attempted by the reporter because the failing allocation path requires device-specific setup.

Successful exploitation of a kernel double free typically enables slab freelist corruption, which attackers can shape into arbitrary write primitives and escalate to root. No public proof-of-concept exploit is available at the time of writing.

Detection Methods for CVE-2026-64118

Indicators of Compromise

Kernel oops or panic messages referencing qed_cid_map_free, qed_cxt_mngr_free, or bitmap_free in dmesg
KASAN reports of double-free or invalid-free originating from the qed module
SLUB debug output indicating Object already free or Redzone overwritten during qed driver load
Repeated crashes correlated with QLogic FastLinQ device probe or driver reload events

Detection Strategies

Enable CONFIG_KASAN and CONFIG_SLUB_DEBUG on test kernels to catch double free conditions during driver initialization
Collect kernel crash dumps via kdump and inspect stack traces for the qed_cxt_tables_alloc call chain
Audit installed kernel packages against distribution advisories to identify hosts still running vulnerable qed code

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a central log platform and alert on qed module errors or KASAN traces
Monitor systems with QLogic FastLinQ NICs for unexpected reboots or NIC re-initialization loops
Track kernel version inventory across the fleet to confirm patch coverage on hosts loading the qed driver

How to Mitigate CVE-2026-64118

Immediate Actions Required

Apply the upstream stable kernel updates that set each CID bitmap pointer to NULL after bitmap_free() in qed_cid_map_alloc()
Prioritize patching servers equipped with QLogic FastLinQ 4xxxx adapters, where the qed driver is loaded automatically
Restrict local access on affected hosts until patched kernels are deployed and rebooted

Patch Information

The fix has been merged across multiple stable branches. Refer to the upstream commits for the exact change:

Workarounds

Blacklist the qed module on systems that do not require QLogic FastLinQ networking to prevent the vulnerable code path from loading
Use alternate NIC hardware or drivers on high-value hosts until kernel updates are applied
Limit interactive and SSH access to trusted administrators on hosts that must run the unpatched qed driver

bash

# Blacklist the qed driver until the patched kernel is installed
echo 'blacklist qed' | sudo tee /etc/modprobe.d/blacklist-qed.conf
sudo depmod -a
sudo update-initramfs -u

# Verify the driver is not loaded after reboot
lsmod | grep qed