{"id":"CVE-2026-81008","title":"interconnect: Fix use after free in icc_get() and of_icc_get_by_index()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ninterconnect: Fix use after free in icc_get() and of_icc_get_by_index()\n\nIn of_icc_get_by_index() and icc_get(), if the dynamic allocation for\npath->name fails via kasp…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-825"],"vendor":"Linux","product":"Linux","affected":["Linux >= 3791163602f7140011a8dc1691cfe6ec0cb1ef07 < 03c3af594dea9196cf6ca70d914b42aa8c873c35","Linux >= 3791163602f7140011a8dc1691cfe6ec0cb1ef07 < d4d73decdb9a44a248b1cbd04ed6f334df544d9c","Linux >= 3791163602f7140011a8dc1691cfe6ec0cb1ef07 < 9a671125d4228357e5b929733c4593d27a273749","Linux >= 3791163602f7140011a8dc1691cfe6ec0cb1ef07 < fedea72e8f312fe7d0c6cb19353e61d2d5643b11","Linux >= 3791163602f7140011a8dc1691cfe6ec0cb1ef07 < a4e9aa7907ade87d1d96853d14e05dcf682f8363","Linux >= 3791163602f7140011a8dc1691cfe6ec0cb1ef07 < db8147c5d5ad2cfa21c2be566f95981b41b05de6","Linux >= 3791163602f7140011a8dc1691cfe6ec0cb1ef07 < d715d19cfcfe99f361adb05cefc143a95d400b87","Linux >= 3791163602f7140011a8dc1691cfe6ec0cb1ef07 < 25c7e242aca084fdc1098248194032317dca625d","Linux 5.6"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:46:33.532Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-81008","references":[{"url":"https://git.kernel.org/stable/c/03c3af594dea9196cf6ca70d914b42aa8c873c35"},{"url":"https://git.kernel.org/stable/c/d4d73decdb9a44a248b1cbd04ed6f334df544d9c"},{"url":"https://git.kernel.org/stable/c/9a671125d4228357e5b929733c4593d27a273749"},{"url":"https://git.kernel.org/stable/c/fedea72e8f312fe7d0c6cb19353e61d2d5643b11"},{"url":"https://git.kernel.org/stable/c/a4e9aa7907ade87d1d96853d14e05dcf682f8363"},{"url":"https://git.kernel.org/stable/c/db8147c5d5ad2cfa21c2be566f95981b41b05de6"},{"url":"https://git.kernel.org/stable/c/d715d19cfcfe99f361adb05cefc143a95d400b87"},{"url":"https://git.kernel.org/stable/c/25c7e242aca084fdc1098248194032317dca625d"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81008.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-81008"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532455"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81008"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81008"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-81008.mbox"}],"tags":["cve.org","csaf","vex","red-hat"],"epss":0.00164,"epssPercentile":0.05553,"scores":{"cna":7.8,"vendor":7},"ingestedAt":"2026-09-14T15:23:07.454Z","slug":"CVE-2026-81008","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ninterconnect: Fix use after free in icc_get() and of_icc_get_by_index()\n\nIn of_icc_get_by_index() and icc_get(), if the dynamic allocation for\npath->name fails via kasprintf(), the error handling path directly\ncalls kfree(path) to free the path object and returns an error.\n\nHowever, prior to this point, path_find() calls path_init(), which\nalready links the path's requests into the req_list of the respective\ninterconnect nodes via hlist_add_head(). Directly invoking kfree(path)\nleaves dangling pointers in the hlist. A subsequent call to icc_get()\nor icc_set_bw() will traverse or modify these corrupted lists, triggering\na slab use afterfree.\n\nKASAN report showing the vulnerability when reproducing via debugfs:\n\n  BUG: KASAN: slab-use-after-free in path_find+0x6f8/0xcfc\n  Write of size 8 at addr fff000000d43f748 by task sh/1\n  ...\n  Call trace:\n   kasan_report+0xac/0xfc\n   path_find+0x6f8/0xcfc\n   icc_get+0x148/0x380\n   icc_get_set+0xf8/0x2d0\n  ...\n  Freed by task 1:\n   kfree+0x1a0/0x4a4\n   icc_get+0x2cc/0x380\n   icc_get_set+0xf8/0x2d0\n\nFix this by replacing kfree(path) with the proper teardown function,\nicc_put(path), which safely removes the requests from the req_list using\nhlist_del() and drops the provider usage references before freeing the\nmemory.\n\nAdditionally, in icc_get(), ensure that the icc_lock mutex is released\nprior to calling icc_put(path) to avoid a deadlock, as icc_put()\ninternally acquires the same lock.\n\n## Affected\n\n- `Linux >= 3791163602f7140011a8dc1691cfe6ec0cb1ef07 < 03c3af594dea9196cf6ca70d914b42aa8c873c35`\n- `Linux >= 3791163602f7140011a8dc1691cfe6ec0cb1ef07 < d4d73decdb9a44a248b1cbd04ed6f334df544d9c`\n- `Linux >= 3791163602f7140011a8dc1691cfe6ec0cb1ef07 < 9a671125d4228357e5b929733c4593d27a273749`\n- `Linux >= 3791163602f7140011a8dc1691cfe6ec0cb1ef07 < fedea72e8f312fe7d0c6cb19353e61d2d5643b11`\n- `Linux >= 3791163602f7140011a8dc1691cfe6ec0cb1ef07 < a4e9aa7907ade87d1d96853d14e05dcf682f8363`\n- `Linux >= 3791163602f7140011a8dc1691cfe6ec0cb1ef07 < db8147c5d5ad2cfa21c2be566f95981b41b05de6`\n- `Linux >= 3791163602f7140011a8dc1691cfe6ec0cb1ef07 < d715d19cfcfe99f361adb05cefc143a95d400b87`\n- `Linux >= 3791163602f7140011a8dc1691cfe6ec0cb1ef07 < 25c7e242aca084fdc1098248194032317dca625d`\n- `Linux 5.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81008.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":224773,"id":"CVE-2026-81008","ts":1792401534437,"field":"cvss","old":"7","new":"7.8"},{"seq":204137,"id":"CVE-2026-81008","ts":1789490232020,"field":"cvss","old":"7.8","new":"7"},{"seq":183570,"id":"CVE-2026-81008","ts":1789356675928,"field":"cvss","old":"7.8","new":"4.7"},{"seq":183569,"id":"CVE-2026-81008","ts":1789356675928,"field":"severity","old":"high","new":"medium"},{"seq":153204,"id":"CVE-2026-81008","ts":1789285349537,"field":"cvss","old":null,"new":"7.8"},{"seq":153203,"id":"CVE-2026-81008","ts":1789285349537,"field":"severity","old":"none","new":"high"},{"seq":147179,"id":"CVE-2026-81008","ts":1789270199275,"field":"cvss","old":null,"new":"4.7"},{"seq":147178,"id":"CVE-2026-81008","ts":1789270199275,"field":"severity","old":"none","new":"medium"},{"seq":108928,"id":"CVE-2026-81008","ts":1789183729584,"field":"cvss","old":null,"new":"4.7"},{"seq":108927,"id":"CVE-2026-81008","ts":1789183729584,"field":"severity","old":"none","new":"medium"}]}