Skip to main content

Linux Kernel EUVDEUVD-2026-48658

| CVE-2026-64249 HIGH
Use After Free (CWE-416)
2026-07-24 Linux GHSA-hmrv-6g38-c354
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local access with low privileges is the minimum to trigger the FPGA region error path; UAF in kernel space carries full C/I/A impact potential with no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 13, 2026 - 20:50 vuln.today
CVSS changed
Aug 13, 2026 - 18:37 NVD
7.8 (HIGH)
Patch available
Jul 24, 2026 - 17:48 EUVD
CVE Published
Jul 24, 2026 - 15:31 nvd
HIGH 7.8
CVE Published
Jul 24, 2026 - 15:31 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

fpga: region: fix use-after-free in child_regions_with_firmware()

Move of_node_put(child_region) after the error print to avoid accessing freed memory when pr_err() references child_region.

[ Yilun: Fix the Fixes tag ]

AnalysisAI

Use-after-free in the Linux kernel FPGA region subsystem allows a local authenticated attacker with low privileges to corrupt kernel memory, potentially achieving full confidentiality, integrity, and availability impact. The flaw in child_regions_with_firmware() stems from of_node_put(child_region) freeing the node before pr_err() dereferences the same pointer on an error path - a deterministic UAF triggered by a specific error condition in FPGA device tree enumeration. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), placing this firmly as a maintenance-priority fix for most environments rather than an emergency response item.

Technical ContextAI

The vulnerability is in the Linux kernel FPGA framework, specifically drivers/fpga/fpga-region.c, within the child_regions_with_firmware() function that iterates over OpenFirmware (device tree) child nodes during FPGA region enumeration. of_node_put() decrements the reference count of a struct device_node (child_region); if the reference count drops to zero, the kernel frees that memory. The immediately following pr_err() call then dereferences the now-freed child_region pointer, constituting a classic CWE-416 (Use After Free). UAF in kernel context can lead to type confusion, heap corruption, or-under exploitation-arbitrary kernel code execution. The bug was introduced by commit 0fa20cdfcc1f68847cdfc47824476301eedc8297 at Linux 4.10, as confirmed by the EUVD affected-version range. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* scopes the affected product to the Linux kernel itself across all architectures where the FPGA region driver is compiled.

RemediationAI

Upgrade the Linux kernel to a patched stable release: 7.1.3, 5.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, or 6.18.38, depending on which stable branch is in use; kernel 7.2-rc1 also incorporates the fix. Upstream fix commits are indexed at https://git.kernel.org/stable/c/e918942bcc5355ad5b44ba557935dffc0727b0eb and the additional branch-specific commits in the CVE references. Linux distribution vendors (RHEL, Debian, Ubuntu, SLES) are expected to carry these fixes in their normal kernel security update streams. As a targeted compensating control on hosts that do not use FPGA hardware, administrators can blacklist the fpga_region kernel module by adding blacklist fpga_region to /etc/modprobe.d/blacklist.conf and rebooting - this eliminates the vulnerable code path entirely with no impact on non-FPGA workloads. Verify module absence with lsmod | grep fpga. The trade-off is that any FPGA-dependent functionality will cease, which is acceptable on general-purpose servers.

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

EUVD-2026-48658 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy