EUVD-2026-76416
GHSA-82cq-j2q5-4p5v
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition between work queue and device teardown requires timing control, warranting AC:H; local-only access and low-privilege requirement confirmed by driver interaction model.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
RDMA/cxgb4: Cancel reg_work before freeing device on remove
c4iw_uld_state_change() queues reg_work to register the RDMA device. c4iw_remove() can free ctx->dev while this work is pending or running, leaving c4iw_register_device() accessing the freed device.
Cancel reg_work before removing the device. The registration work can tear down ctx->dev when registration fails, so do not unregister or deallocate it again in that case.
This issue was found by an in-house static analysis tool.
AnalysisAI
Use-after-free in the Linux kernel's RDMA/cxgb4 driver (Chelsio T4/T5/T6 RDMA support) allows a local low-privileged attacker to trigger kernel heap memory corruption by racing device removal against deferred RDMA device registration work. The driver's c4iw_remove() teardown path frees ctx->dev while a reg_work work item queued by c4iw_uld_state_change() may still be executing, leaving c4iw_register_device() operating on freed memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) Chelsio T4, T5, or T6 series RDMA-capable network hardware present in the system with the cxgb4 kernel module loaded; (2) local system access with at least low-privilege user rights capable of interacting with the RDMA subsystem or triggering device removal events (PR:L per CVSS); (3) the ability to race device removal or driver unload (`c4iw_remove()`) against a pending `reg_work` work queue execution - a timing-dependent race condition that requires repeated attempts or precise scheduling control. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) captures the local privilege escalation potential accurately, though AC:L may understate exploitation difficulty - this is fundamentally a race condition between work queue execution and device teardown, which typically warrants AC:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to patched Linux kernel versions 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1, which include the fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems in your infrastructure using Chelsio T4/T5/T6 RDMA adapters and verify current kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today