CVE-2026-64188: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64188 Overview

CVE-2026-64188 is a use-after-free vulnerability in the Linux kernel's Qualcomm rmnet network driver. The flaw exists in rmnet_dellink(), which removes an endpoint from a hash table with hlist_del_init_rcu() and immediately frees it with kfree(). Concurrent Read-Copy-Update (RCU) readers on the receive path can still hold a reference to the endpoint and dereference ep->egress_dev after the memory has been released. The endpoint object is allocated from the kmalloc-32 slab cache, and the stale read at offset 8 corresponds to the egress_dev pointer. Exploitation can trigger a kernel page fault and potentially lead to kernel memory corruption.

Critical Impact
A local attacker capable of interacting with rmnet devices can trigger a kernel use-after-free that leads to system crash or potential privilege escalation through kernel memory corruption.

Affected Products

Linux Kernel — net/qualcomm/rmnet driver (multiple stable branches referenced by fix commits)
Systems using Qualcomm rmnet for cellular/WWAN networking (mobile devices, embedded platforms)
Distributions shipping unpatched Linux kernels with the rmnet driver enabled

Discovery Timeline

2026-07-20 - CVE-2026-64188 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64188

Vulnerability Analysis

The vulnerability resides in the rmnet_dellink() function within the Qualcomm rmnet driver at drivers/net/ethernet/qualcomm/rmnet/. When an rmnet endpoint is deleted, the code removes it from the RCU-protected hash table with hlist_del_init_rcu() and then immediately frees the memory with kfree(). This violates RCU semantics because in-flight readers on the packet receive path — specifically rmnet_rx_handler() calling into __rmnet_map_ingress_handler() — may still hold a pointer to the endpoint structure obtained before the deletion.

When such a reader dereferences ep->egress_dev after the free, it reads freed slab memory. The reported crash shows a page fault at rmnet_vnd_rx_fixup triggered from the network receive path through tun_get_user() and tun_chr_write_iter(), indicating a locally reachable attack surface via TUN/TAP writes into an rmnet-attached interface.

Root Cause

The root cause is a lifecycle mismatch between the RCU-protected removal and the synchronous deallocation of the endpoint structure. The rmnet_endpoint object lacked an rcu_head field and was freed with kfree() rather than kfree_rcu(), so no grace period elapsed before the memory was returned to the slab allocator. A secondary issue is that rmnet_vnd_dellink() sets ep->egress_dev to NULL while lockless readers may still be traversing the pointer, creating a data race.

Attack Vector

An attacker with the ability to create or destroy rmnet link endpoints and inject packets into the receive path can race a link deletion against packet processing. The reproducer referenced in the crash log (poc_write) writes packets through a TUN device to trigger __netif_receive_skb_core() on an rmnet interface while another thread deletes the endpoint. Successful exploitation causes a kernel use-after-free that manifests as an oops or, with heap grooming, can be leveraged for kernel memory corruption and privilege escalation. The vulnerability is described in the upstream fix commit.

// Vulnerable pattern (conceptual - see upstream commits for actual diff)
// rmnet_dellink():
//     hlist_del_init_rcu(&ep->hlnode);
//     kfree(ep);                        // <-- freed while RCU readers may still dereference
//
// Fixed pattern:
//     hlist_del_init_rcu(&ep->hlnode);
//     kfree_rcu(ep, rcu);               // defer free until RCU grace period expires

Detection Methods for CVE-2026-64188

Indicators of Compromise

Kernel oops or page fault messages referencing rmnet_vnd_rx_fixup, __rmnet_map_ingress_handler, or rmnet_rx_handler in dmesg or /var/log/kern.log
Unexpected crashes on systems using the Qualcomm rmnet driver, particularly during rmnet link teardown
KASAN reports flagging use-after-free at offset 8 of a kmalloc-32 object originating from rmnet_dellink()

Detection Strategies

Enable CONFIG_KASAN on test and staging kernels to catch use-after-free accesses in rmnet code paths at runtime
Monitor kernel ring buffer for oops signatures matching the call stack tun_chr_write_iter -> netif_receive_skb -> rmnet_rx_handler
Audit installed kernel package versions against the fix commits listed on git.kernel.org to identify hosts still exposed

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on BUG:, Oops:, or general protection fault entries mentioning rmnet symbols
Track creation and deletion events for rmnet* netdevices using audit rules on RTM_NEWLINK and RTM_DELLINK netlink messages
Correlate crash telemetry with recent rmnet configuration changes to identify potential exploitation attempts

How to Mitigate CVE-2026-64188

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 1078ae8, 310b932, 41e06fc, 8b17adf, 9918698, c4e676c, d00c953, and f193e38 from git.kernel.org
Update to a distribution kernel that incorporates the rmnet kfree_rcu() fix
Restrict unprivileged access to netlink and TUN/TAP interfaces on systems where the rmnet driver is loaded

Patch Information

The fix adds an rcu_head field to struct rmnet_endpoint and replaces the direct kfree() in rmnet_dellink() with kfree_rcu(), ensuring the endpoint memory remains valid throughout the RCU grace period. The patch also removes the rmnet_vnd_dellink() call and inlines only the nr_rmnet_devs decrement, eliminating the data race where ep->egress_dev would be set to NULL while lockless readers were still traversing it. Fix commits are published on git.kernel.org stable.

Workarounds

Unload the rmnet kernel module on systems that do not require Qualcomm cellular networking: modprobe -r rmnet
Blacklist the rmnet module in /etc/modprobe.d/ to prevent automatic loading on affected hosts
Restrict CAP_NET_ADMIN to trusted users and disable unprivileged user namespaces to reduce the attack surface

bash

# Prevent the rmnet module from loading on hosts that do not need it
echo "blacklist rmnet" | sudo tee /etc/modprobe.d/blacklist-rmnet.conf
echo "install rmnet /bin/true" | sudo tee -a /etc/modprobe.d/blacklist-rmnet.conf
sudo update-initramfs -u

# Restrict unprivileged user namespace creation to limit local attack surface
sudo sysctl -w kernel.unprivileged_userns_clone=0
echo "kernel.unprivileged_userns_clone=0" | sudo tee -a /etc/sysctl.d/99-hardening.conf