Look up another CVE · open CVE-2026-64188 in the interactive tracker

CVE-2026-64188

net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()

7.8 EPSS 0.1% AV:L

Published 2026-07-20 (3 months ago) by the Linux kernel CNA. Subsystem drivers/net. Debian urgency: not yet assigned.

What to do, per Debian release

Debian's own status for CVE-2026-64188 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	fixed	6.1.177-1	Update the kernel and reboot. Fixed in 6.1.177-1. A running kernel keeps the old code until the machine restarts.
Debian 13trixie	fixed	6.12.95-1	Update the kernel and reboot. Fixed in 6.12.95-1. A running kernel keeps the old code until the machine restarts.
Debian 14forky	fixed	7.0.14-1	Update the kernel and reboot. Fixed in 7.0.14-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.0.14-1	Update the kernel and reboot. Fixed in 7.0.14-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

rmnet_dellink() removes the endpoint from the hash table with hlist_del_init_rcu() and then immediately frees it with kfree(). However, RCU readers on the receive path (rmnet_rx_handler -> __rmnet_map_ingress_handler) may still hold a reference to the endpoint and dereference ep->egress_dev after the memory has been freed. The endpoint is a kmalloc-32 object, and the stale read at offset 8 corresponds to the egress_dev pointer. BUG: unable to handle page fault for address: ffffffffde942eef Oops: 0002 [#1] SMP NOPTI CPU: 1 UID: 0 PID: 137 Comm: poc_write Not tainted 7.0.0+ #4 PREEMPTLAZY RIP: 0010:rmnet_vnd_rx_fixup (rmnet_vnd.c:27) Call Trace: <TASK> __rmnet_map_ingress_handler (rmnet_handlers.c:48 rmnet_handlers.c:101) rmnet_rx_handler (rmnet_handlers.c:129 rmnet_handlers.c:235) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6096) __netif_receive_skb_one_core (net/core/dev.c:6208) netif_receive_skb (net/core/dev.c:6467) tun_get_user (drivers/net/tun.c:1955) tun_chr_write_iter (drivers/net/tun.c:2003) vfs_write (fs/read_write.c:688) ksys_write (fs/read_write.c:740) </TASK> Add an rcu_head field to struct rmnet_endpoint and replace kfree() with kfree_rcu() so the endpoint memory remains valid through the RCU grace period. Also remove the rmnet_vnd_dellink() call and inline only the nr_rmnet_devs decrement, since rmnet_vnd_dellink() would set ep->egress_dev to NULL during the grace period, creating a data race with lockless readers.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h

What this is: QUALCOMM RMNET DRIVERMAINTAINERS section matched on drivers/net/ethernet/qualcomm/rmnet/ · netdev@vger.kernel.org · Maintained
Kernel module: rmnet

Check it on the machine

grep -wE 'CONFIG_ETHERNET|CONFIG_NET_VENDOR_QUALCOMM|CONFIG_RMNET' /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w rmnet

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian does not build this code in 2 releases. It does build it in 2 releases, so the answer depends on which release the machine runs.

bookworm, trixien
forky, sidMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt-amd64, arm64/cloud-arm64, armhf/armmp, armhf/armmp-lpae, loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, riscv64/riscv64, s390x/s390x

n: not enabled on any flavour - this release does not build the code
M: a module where it is built at all; some flavours do not build it

Build switches: CONFIG_ETHERNET, CONFIG_NET_VENDOR_QUALCOMM, CONFIG_RMNET
Reads as: all on means the file is compiled; any one off means it is not.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-07-20 (3 months ago)source
CVSS: 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it
Attack vector: local (AV:L)source
EPSS: 0.12%, higher than 1.6% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: not yet assignedsource
Subsystem: drivers/net

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
4.14	5.10.260	c4e676c3505c
4.14	5.15.211	9918698cf3ae
4.14	6.1.177	310b93246bfe
4.14	6.6.144	1078ae817577
4.14	6.12.95	41e06fcc5df0
4.14	6.18.37	8b17adf6d4fb
4.14	7.0.14	f193e38cb257
4.14	7.1	d00c953a8f69

Debian advisories

Advisory	Date	Shipped to	Debian
DLA-4717-1	2026-08-05	bullseye 5.10.262-1	tracker
DLA-4700-1	2026-07-26	bullseye 6.1.177-1~deb11u1	tracker

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local: The complete exploit path is local: attacker-written frames enter through TUN while RTM_DELLINK over NETLINK_ROUTE invokes rmnet_dellink(); remote traffic alone cannot perform the required endpoint deletion.
AC:LAttack complexity, low: The attacker controls both sides of the race by concurrently injecting crafted MAP frames and deleting or recreating the RMNET link, allowing repeated attempts without an uncontrollable condition.
PR:LPrivileges required, low: Deletion requires CAP_NET_ADMIN in the route socket's network namespace, which an unprivileged user can obtain through a private user and network namespace to create TUN and RMNET devices.
UI:NUser interaction, none: No separate victim action is required because the attacker directly performs link setup, packet injection, and deletion.
S:UScope, unchanged: Exploitation compromises the kernel within the same security authority and does not cross a VM, IOMMU, or comparable scope boundary.
C:HConfidentiality impact, high: The freed kmalloc-32 endpoint can be reclaimed with attacker-influenced contents, making the stale egress_dev pointer usable for forged-object dereferences and access to sensitive kernel memory.
I:HIntegrity impact, high: The corrupted egress_dev pointer reaches rmnet_vnd_rx_fixup, where derived per-CPU statistics pointers are written, providing a plausible path to arbitrary memory corruption and control-flow hijacking.
A:HAvailability impact, high: The demonstrated race causes a page fault and kernel Oops in rmnet_vnd_rx_fixup, and it can be triggered repeatedly to crash the system.