CVE-2026-81008: Linux Kernel Use-After-Free Vulnerability

CVE-2026-81008 Overview

CVE-2026-81008 is a use-after-free vulnerability in the Linux kernel's interconnect framework. The flaw resides in of_icc_get_by_index() and icc_get() functions in drivers/interconnect/core.c. When a dynamic allocation of path->name via kasprintf() fails, the error path directly calls kfree(path) on the path object. However, path_find() has already linked the path's requests into the req_list of interconnect nodes via hlist_add_head(). Freeing the path without unlinking leaves dangling pointers in the hash list. Any subsequent call to icc_get() or icc_set_bw() triggers a slab use-after-free when traversing the corrupted list.

Critical Impact
A local, low-privileged attacker able to trigger the failing allocation path can corrupt kernel memory, resulting in potential privilege escalation, kernel information disclosure, or a system crash.

Affected Products

Linux kernel versions containing the interconnect framework prior to the fix commits
Distributions shipping affected upstream kernels
Embedded and mobile platforms (notably Qualcomm-based systems that rely heavily on the interconnect framework)

Discovery Timeline

2026-09-11 - CVE-2026-81008 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-81008

Vulnerability Analysis

The Linux interconnect framework manages bandwidth requests between hardware nodes on System-on-Chip (SoC) platforms. When a consumer driver requests a path, of_icc_get_by_index() or icc_get() allocate a struct icc_path and invoke path_find(). Internally, path_find() calls path_init(), which links each per-node request onto the corresponding node's req_list using hlist_add_head().

After this linkage occurs, the affected functions attempt to duplicate the path name with kasprintf(). If kasprintf() returns NULL, the error handler frees the path directly with kfree(path). The requests remain linked in the node hash lists, pointing to freed memory. Subsequent traversals through path_find() or bandwidth updates through icc_set_bw() dereference those stale pointers, triggering a KASAN slab-use-after-free report.

Root Cause

The root cause is inconsistent teardown logic. path_init() establishes state that must be dismantled through icc_put(), which calls hlist_del() on each request and drops provider usage references. The error path bypasses this teardown and releases only the top-level allocation, violating the ownership contract between path_find() and its caller.

Attack Vector

Exploitation requires local access with the ability to invoke interconnect operations, for example through debugfs or a driver ioctl that indirectly calls icc_get(). An attacker who can induce memory pressure or otherwise fail kasprintf() can force the vulnerable free path. Once the dangling hlist entries exist, further interconnect activity converts the condition into a use-after-free write, which is the primitive typically leveraged for kernel heap manipulation.

No verified public exploit code is available at this time. Reproduction was documented in a KASAN report generated through debugfs interaction with the interconnect subsystem. Refer to the upstream commits for the exact code paths involved: Kernel Commit d715d19 and Kernel Commit a4e9aa7.

Detection Methods for CVE-2026-81008

Indicators of Compromise

KASAN reports referencing slab-use-after-free in path_find with call traces including icc_get and icc_set_bw.
Kernel oops or panic entries in dmesg originating from the drivers/interconnect/core.c code path.
Unexpected process crashes or system instability following interconnect debugfs interaction.

Detection Strategies

Enable KASAN on test and pre-production kernels to surface the use-after-free during fuzzing or QA workloads.
Audit installed kernel package versions against distribution advisories referencing the listed stable commits.
Monitor for local processes invoking interconnect debugfs entries such as /sys/kernel/debug/interconnect/.

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on KASAN or BUG: strings.
Track allocation-failure events via /proc/vmstat and correlate with interconnect subsystem activity.
Restrict and audit access to debugfs; log privileged user activity that touches kernel debug interfaces.

How to Mitigate CVE-2026-81008

Immediate Actions Required

Inventory Linux systems using affected kernel builds, prioritizing Qualcomm-based mobile, embedded, and edge devices.
Apply vendor kernel updates that include the upstream fix commits as soon as they are available.
Restrict local, unprivileged access on systems that cannot be patched immediately.

Patch Information

The fix replaces kfree(path) with icc_put(path), which properly unlinks requests via hlist_del() and drops provider usage references before freeing the memory. Additionally, icc_get() releases the icc_lock mutex before calling icc_put() to avoid a deadlock, since icc_put() acquires the same lock internally. The fix is available in the following stable commits: Kernel Commit 03c3af5, Kernel Commit 25c7e24, Kernel Commit 9a67112, Kernel Commit a4e9aa7, Kernel Commit d4d73de, Kernel Commit d715d19, Kernel Commit db8147c, and Kernel Commit fedea72.

Workarounds

Unmount or restrict access to debugfs where interconnect entries are exposed, particularly on production systems.
Enforce strict local-user access controls and remove unnecessary shell accounts on affected devices.
On systems where the interconnect framework is not required, evaluate building kernels without CONFIG_INTERCONNECT.

bash

# Restrict debugfs access to root only
mount -o remount,mode=700 /sys/kernel/debug

# Verify running kernel version against fixed builds
uname -r

# Check for KASAN reports referencing the interconnect subsystem
dmesg | grep -E 'KASAN|path_find|icc_get'