EUVD-2026-64566
GHSA-8jrf-fhpg-2ggp
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:A because triggering requires adjacent network traffic; AC:H because exploiting the race condition requires precise timing between interrupt and teardown.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net/dibs: Correct freeing of dmb_clientid_arr
A dibs device interrupt handler can be active after dibs_dev_del() and may still access dmb_clientid_arr. (UAF)
In case of a failure in dibs_dev_add() being called by dibs_lo_dev_probe() dmb_clientid_arr is freed twice (double free).
Free dmb_clientid_arr in dibs_dev_release() after last reference is gone. Note that allocating in dibs_dev_add() instead of dibs_dev_alloc() is ok for now, because no dmbs can be registered before dibs_dev_add().
AnalysisAI
Use-after-free and double-free memory corruption in the Linux kernel's net/dibs network subsystem allows an adjacent network attacker to trigger kernel memory corruption via a race condition between the dibs device interrupt handler and device teardown. The UAF arises because an active interrupt handler can continue accessing dmb_clientid_arr after dibs_dev_del() releases it; a separate double-free path exists when dibs_dev_add() fails during dibs_lo_dev_probe(). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the target kernel must have the net/dibs subsystem compiled and actively in use - systems without this module are not affected; (2) for the UAF path, an interrupt must fire on the dibs device while a concurrent dibs_dev_del() is executing, creating a race window - this is a timing-dependent condition that limits reliable exploitation; (3) for the double-free path, dibs_dev_add() must fail during dibs_lo_dev_probe(), which typically requires the attacker to influence kernel device probing conditions or trigger an allocation failure. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) scores 8.8, indicating adjacent-network reachability with no authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker positioned on the same network segment as a host running the Linux kernel with the net/dibs subsystem active sends crafted network traffic to trigger the dibs interrupt handler. If the handler races with an administrator-initiated or kernel-driven dibs_dev_del() call, the attacker may read or corrupt already-freed kernel heap memory via dmb_clientid_arr, potentially overwriting function pointers or security-sensitive kernel structures to escalate privileges or crash the system. … |
| Remediation | Upgrade the Linux kernel to a patched release: 6.18.45 or later for the 6.18 stable branch, 7.1.9 or later for the 7.1 stable branch, or 7.2 or later for the 7.2 mainline branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory and assess all Linux systems with the dibs network subsystem, prioritizing those exposed to untrusted networks; cross-reference against kernel version databases to confirm vulnerability status. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today