EUVD-2026-76676
GHSA-8vmv-qf47-5pwf
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition requires precise concurrent teardown timing, justifying AC:H over the provided AC:L; local low-privilege access is required with full memory corruption impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
rust: devres: fix race between concurrent revokers
There is a potential race condition when two paths try to revoke a Devres concurrently.
The driver core's devres_release_all() calls Revocable::revoke() via the release callback, while Devres::drop() calls revoke_nosync() on another CPU.
The revoker that does not claim the is_available swap returns immediately, but the revoker that did may still be executing drop_in_place() on the inner data. This can cause a use-after-free when the other revoker's caller proceeds to drop adjacent resources that drop_in_place() still references (e.g., Devres<DmaMappedSgt> racing with SGTable freeing the backing sg_table and pages).
Fix this by adding a Completion. The release callback signals the Completion after revoke() finishes, and Devres::drop() waits for it when it loses the is_available swap. This ensures the wrapped object is fully torn down before Devres::drop() returns.
AnalysisAI
Use-after-free in the Linux kernel's Rust devres (device resource management) subsystem allows a local low-privileged attacker to cause kernel memory corruption or achieve privilege escalation. The race triggers when the driver core's devres_release_all() and Devres::drop() concurrently attempt to revoke the same Devres object - the losing revoker returns immediately while the winner's drop_in_place() is still executing, allowing adjacent resources such as DMA scatter-gather tables to be freed beneath active teardown. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local attacker with at least low system privileges (PR:L per CVSS) on a kernel built with CONFIG_RUST=y that has at least one Rust devres-using driver active and performing DMA mappings (e.g., Devres<DmaMappedSgt>). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector scores 7.8 at AV:L/AC:L/PR:L, but AC:L materially understates exploitation difficulty - reliably hitting the concurrent teardown race requires precise interleaving of the driver core release path and Devres drop on separate CPUs, a condition not trivially repeatable outside kernel fuzzing or controlled hardware manipulation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux 7.2.4 or apply the 7.3-rc1 tree, which contains the Completion-based synchronization fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory Linux systems running Rust device drivers and assess which ones allow unprivileged local user access (servers, containers, workstations). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today