Skip to main content

Linux Kernel CVE-2026-64582

| EUVDEUVD-2026-53329 HIGH
Use After Free (CWE-416)
2026-08-05 Linux GHSA-9mqw-m8jv-5hmw
Denial Of Service Linux Use After Free Memory Corruption Canonical
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local account with RDMA group membership
  2. Delivery
    Verify rdma_rxe module is loaded and uverbs device accessible
  3. Exploit
    Create Completion Queue via IB uverbs ioctl
  4. Execution
    Race mmap() of CQ memory region against concurrent DESTROY_CQ ioctl
  5. Persist
    vfree() clears vmalloc PTEs during remap_vmalloc_range_partial() PTE walk
  6. Impact
    Kernel GPF crash (DoS) or stale PTE inserted into user VMA enabling page-level UAF

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The rdma_rxe (SoftRoCE) kernel module must be loaded - it is not loaded by default on most Linux distributions and requires explicit configuration of RDMA over Ethernet. The attacker must have a local user account with sufficient privilege to open an InfiniBand uverbs character device (typically /dev/infiniband/uverbsN), which on most distributions requires membership in the 'rdma' or 'infiniband' group or equivalent - not a default entitlement for standard users. The attacker must be able to create a Completion Queue (CQ) object and then race an mmap() of that CQ's memory region against a concurrent DESTROY_CQ ioctl targeting the same CQ. Exploitation is limited to this very narrow CPU scheduling race window; the CVE description explicitly notes the page-level UAF variant is 'statistically very difficult to achieve.' The kernel crash variant (DoS) is more easily triggered. The vulnerability does not affect systems without RDMA/rxe loaded, container-isolated workloads without host RDMA device access, or systems where non-privileged users lack access to /dev/infiniband/.
Impact

The NVD-assigned CVSS 3.1 score of 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H overstates exploitability at the AC:L level. The CVE description explicitly states the page-level UAF is 'statistically very difficult to achieve given the very short time window,' which is inconsistent with AC:L and argues for AC:H. The more realistic and reliably triggerable impact is a kernel crash (Denial of Service), not full memory corruption. EPSS at 0.16% (5th percentile) corroborates the low practical exploitation probability. No CISA KEV listing confirms no observed active exploitation. A functional reproducer appears to have been used by the reporter (detailed kernel oops with KASAN/KCOV instrumentation is present in the description), but public exploit code availability is not confirmed. Real-world risk is further constrained by the requirement that rdma_rxe be loaded and the attacker have user-level access to /dev/infiniband/uverbsN - not a default configuration on most Linux deployments. For HPC, data-center, and cloud RDMA environments this warrants prompt patching; for general-purpose Linux deployments without RDMA, exposure is negligible.
Exploit ScenarioDerived

A local user with access to the InfiniBand uverbs device spawns two threads: one calls mmap() on a CQ (Completion Queue) memory region to invoke rxe_mmap(), while the other simultaneously issues a DESTROY_CQ ioctl. If the DESTROY_CQ kref decrement hits zero during rxe_mmap()'s PTE-walking phase, vfree() clears the vmalloc mappings mid-walk, producing a GPF crash in the kernel. In the narrow window between the last vm_insert_page() call and the subsequent kref_get(), a stale PTE pointing to the freed page may be installed in the user's VMA, and if that page is later reallocated by vmalloc, the user gains a read/write primitive against it. No confirmed public exploit code exists at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 08, 2026

Use-after-free race condition in the Linux kernel's RDMA/rxe (SoftRoCE) subsystem allows a local unprivileged user to trigger a kernel crash or achieve page-level memory corruption. The race occurs between rxe_mmap() - which releases pending_lock while a rxe_mmap_info kref is still live - and a concurrent DESTROY_CQ ioctl that drops the kref to zero, causing vfree() to clear vmalloc PTEs mid-walk in remap_vmalloc_range_partial(). No CISA KEV listing exists and EPSS is 0.16% (5th percentile), reflecting the race's very narrow exploitation window; however, the C:H/I:H/A:H impact and confirmed upstream patch make this a priority update for any environment with RDMA/rxe loaded.

RemediationAI

Upgrade the Linux kernel to a patched release: 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1. Upstream fix commits are available at https://git.kernel.org/stable/c/665fb7d22a700c66a78db0cf88c6e6a649aba9d0, https://git.kernel.org/stable/c/e038d42cc09ca1da9d3568ce8ae062b2bfb3bc0e, https://git.kernel.org/stable/c/e59a6aa89e0fcd1d0707832eb4654fd9ae7d31e6, https://git.kernel.org/stable/c/3525987a392536f31a484833af258971af63b24c, and https://git.kernel.org/stable/c/35744ab3d03c5fca8c1752f53fc8fc674e14c561. For systems that cannot immediately patch, unloading the rdma_rxe module via 'modprobe -r rdma_rxe' eliminates the attack surface entirely, at the cost of disabling SoftRoCE functionality - acceptable if RDMA is not operationally required. Systems that do not use RDMA should blacklist the module in /etc/modprobe.d/ to prevent accidental future loading. Ubuntu-specific guidance should be sourced from Canonical's security advisories. Additional references: https://nvd.nist.gov/vuln/detail/CVE-2026-64582 and ENISA EUVD-2026-53329.

Affected VersionsENISA

Linux 8700e3e7c4857d28ebaa824509934556da0b3e76 <665fb7d22a700c66a78db0cf88c6e6a649aba9d0
Linux patch: 7.2-rc1
Linux 8700e3e7c4857d28ebaa824509934556da0b3e76 <e038d42cc09ca1da9d3568ce8ae062b2bfb3bc0e
Linux patch: 6.6.145
Linux 8700e3e7c4857d28ebaa824509934556da0b3e76 <35744ab3d03c5fca8c1752f53fc8fc674e14c561
Linux 8700e3e7c4857d28ebaa824509934556da0b3e76 <3525987a392536f31a484833af258971af63b24c
Linux patch: 7.1.5
Linux 4.8
Linux patch: 6.12.97
Linux 8700e3e7c4857d28ebaa824509934556da0b3e76 <e59a6aa89e0fcd1d0707832eb4654fd9ae7d31e6
Linux patch: 0
Linux patch: 6.18.40

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability is in rxe_mmap() within the Linux kernel's RDMA RXE subsystem (Soft RDMA over Ethernet / SoftRoCE), which implements InfiniBand semantics over standard Ethernet. The affected CPE is cpe:2.3:a:linux:linux across versions starting at commit 8700e3e7c4857d28ebaa824509934556da0b3e76. The root cause is a TOCTOU race (CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization; CWE-416: Use After Free): rxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list and releases pending_lock while the struct's kref is still 1. A concurrent DESTROY_CQ ioctl on another CPU calls kref_put() to 0, which triggers vfree(ip->obj) clearing vmalloc PTEs, followed by kfree(ip), while remap_vmalloc_range_partial() is still iterating those same PTEs without any lock held. This produces two outcomes: (1) a GPF kernel crash when vmalloc_to_page() returns NULL, leading to vm_insert_page(NULL) faulting in validate_page_before_insert; or (2) a page-level UAF where a stale PTE pointing to a freed vmalloc page is inserted into the user VMA, enabling that page to be reallocated by vmalloc and subsequently read or written by the attacker. The call trace confirms KASAN detection under a 7.0.0-rc5 kernel.

Know when Canonical gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Race condition requires precise inter-CPU timing (AC:H); local user with RDMA device group access required (PR:L, AV:L); full kernel memory impact justified by confirmed page-level UAF primitive.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 6.4 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.0 HIGH

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Aug 08, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Aug 05, 2026 - 12:01 EUVD
CVE Published
Aug 05, 2026 - 11:25 cve.org
HIGH 7.8
CVE Published
Aug 05, 2026 - 11:25 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix a use-after-free problem in rxe_mmap

rxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list and releases pending_lock while the struct's kref is still at 1:

list_del_init(&ip->pending_mmaps); spin_unlock_bh(&rxe->pending_lock); /* ref == 1, no lock held */ ret = remap_vmalloc_range(vma, ip->obj, 0); /* walks PTEs */ [...] rxe_vma_open(vma); /* kref_get, ref → 2 */ remap_vmalloc_range_partial() walks PTEs without any lock.

A concurrent DESTROY_CQ ioctl on another CPU calls:

kref_put(&q->ip->ref, rxe_mmap_release) /* ref 1→0 */ vfree(ip->obj) /* clears vmalloc PTEs mid-walk */ kfree(ip) /* frees rxe_mmap_info */

This yields:

  1. Kernel crash, vmalloc_to_page() returns NULL when vfree wins the

per-PTE race -> vm_insert_page(NULL) → GPF in validate_page_before_insert

  1. Page UAF, vmalloc_to_page() reads a stale PTE before vfree clears

it. User VMA holds a PTE to a free'd page which might eventually get reallocated later by vmalloc which allows the attacker to get a clean page-level UAF.

It is worth noting that even though a page-level UAF is possible given the strong primitive, it is statistically very difficult to achieve given the very short time window (after the last insert_page and before the kref_get).

The call trace are as below:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 UID: 1000 PID: 413 Comm: poc Not tainted 7.0.0-rc5-dirty #28 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:validate_page_before_insert+0x32/0x300 Code: e5 41 57 41 56 49 89 fe 41 55 41 54 53 48 89 f3 e8 93 b5 a3 ff 48 8d 7b 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 7b 02 00 00 4c 8b 63 08 31 ff 4d 89 e5 41 83 e5 RSP: 0018:ffff88811b15f2f0 EFLAGS: 00000202 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000008 RBP: ffff88811b15f318 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8881181eee00 R13: 0000000000000000 R14: ffff8881181eee00 R15: ffff8881181eee20 FS: 00007b1e000f76c0(0000) GS:ffff8884268e0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007b1e00a24ac0 CR3: 0000000116eb3000 CR4: 00000000000006f0 Call Trace: <TASK> insert_page+0x8f/0x190 ? __pfx_insert_page+0x10/0x10 ? kasan_save_alloc_info+0x38/0x60 vm_insert_page+0x2e7/0x400 remap_vmalloc_range_partial+0x212/0x3e0 remap_vmalloc_range+0x6e/0xb0 ? __kasan_check_write+0x14/0x30 rxe_mmap+0x2e9/0x5d0 ib_uverbs_mmap+0x1ad/0x2c0 __mmap_region+0x12c2/0x2ad0 ? __pfx___mmap_region+0x10/0x10 ? __sanitizer_cov_trace_switch+0x58/0xb0 ? mas_prev_slot+0x360/0x39c0 ? __sanitizer_cov_trace_switch+0x58/0xb0 ? mas_next_slot+0x1e5b/0x2f40 ? __sanitizer_cov_trace_cmp8+0x18/0x30 ? unmapped_area_topdown+0x4dd/0x610 ? kfree+0x1b1/0x440 ? free_cpumask_var+0x16/0x30 ? __kasan_slab_free+0x7d/0xa0 ? __sanitizer_cov_trace_cmp8+0x18/0x30 mmap_region+0x2e6/0x3c0 do_mmap+0xa3e/0x12a0 ? __pfx_do_mmap+0x10/0x10 ? __kasan_check_write+0x14/0x30 ? down_write_killable+0xba/0x160 ? __pfx_down_write_killable+0x10/0x10 ? __sanitizer_cov_trace_cmp4+0x16/0x30 vm_mmap_pgoff+0x2d4/0x4a0 ? __pfx_vm_mmap_pgoff+0x10/0x10 ? fget+0x1bf/0x270 ksys_mmap_pgoff+0x40c/0x690 ? __sanitizer_cov_trace_const_cmp4+0x16/0x30 ? __pfx_ksys_mmap_pgoff+0x10/0x10 ? __kasan_check_write+0x14/0x30 ? _raw_spin_trylock+0xbb/0x130 ? __pfx__raw_spin_trylock+0x10/0x10 __x64_sys_mmap+0x135/0x1e0 x64_sys_c ---truncated---

Executive ViewAI

Why It Matters

A use-after-free vulnerability in the Linux kernel's RDMA/rxe subsystem (CVE-2026-64582) allows local unprivileged users to crash systems or corrupt kernel memory. This affects organizations running HPC clusters, storage infrastructure, or data-processing systems with RDMA/rxe enabled, creating direct risk to data integrity and system availability. A vendor patch is available.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
Medium
RDMA/rxe requires explicit configuration; primarily HPC and data-center environments
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Canonical

View all
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2016-3714 HIGH POC
8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2016-5195 HIGH POC
7.0 Nov 10

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
CVE-2013-2423 LOW POC
3.7 Apr 17

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-64582 ADVISORY https://ubuntu.com/security/notices/USN-8876-1 ADVISORY https://ubuntu.com/security/notices/USN-8877-1 ADVISORY https://ubuntu.com/security/notices/USN-8878-1 ADVISORY https://ubuntu.com/security/notices/USN-8879-1 ADVISORY https://vuldb.com/vuln/386181 REF https://git.kernel.org/stable/c/3371f2036e0f970166bbb624e25bba46d32fa18e REF https://git.kernel.org/stable/c/3525987a392536f31a484833af258971af63b24c REF https://git.kernel.org/stable/c/35744ab3d03c5fca8c1752f53fc8fc674e14c561 REF https://git.kernel.org/stable/c/665fb7d22a700c66a78db0cf88c6e6a649aba9d0 REF https://git.kernel.org/stable/c/aef5ea8578f97f2701039600846a8bcf5f21e863 REF https://git.kernel.org/stable/c/b810352d0916796dabe633cdb9adee9863ab4911 REF https://git.kernel.org/stable/c/e038d42cc09ca1da9d3568ce8ae062b2bfb3bc0e REF https://git.kernel.org/stable/c/e59a6aa89e0fcd1d0707832eb4654fd9ae7d31e6

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy