CVE-2026-81008

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The interconnect core is an on-chip SoC bandwidth API. of_icc_get_by_index() runs from local consumer-driver probe (Qualcomm GPU, venus/camera, UFS, USB, OPP on Android/embedded) and icc_get() from the optional debugfs test client; no network or adjacent protocol handler reaches this code.

AC:LAttack complexity, low

Once kasprintf() fails after path_init() has linked path->reqs into node req_lists, the dangling hlist pointers persist and the next icc_set_bw()/path_find() is a deterministic UAF, not a race. A local attacker can force the GFP_KERNEL name allocation to fail with memory pressure and retry via driver rebind, module load, or deferred probe.

PR:LPrivileges required, low

After the error path plants dangling req_list entries, an ordinary local/Android user triggers the UAF through icc_set_bw() via V4L2, DRM render nodes, or block I/O on already-probed consumers that share interconnect nodes. of_icc_get() itself runs from consumer probe/rebind whose privilege gating is ambiguous, so Low applies.

UI:NUser interaction, none

The attacker induces memory pressure and device activity (or a rebind/probe) from their own process. No separate victim action such as mounting a filesystem or opening a file is required.

S:UScope, unchanged

The UAF corrupts kernel heap objects and interconnect provider state in the host kernel. This is standard kernel privilege escalation and does not cross a VM, IOMMU, or sandbox security boundary.

C:HConfidentiality impact, high

This is a slab use-after-free of struct icc_path whose embedded icc_req hlist nodes remain on node->req_list. aggregate_requests() and the interconnect debugfs summary read enabled/tag/avg_bw/peak_bw and r->dev from the freed object, so heap reuse yields an arbitrary kernel read primitive.

I:HIntegrity impact, high

path_find() hlist_add_head() performs an 8-byte write through the dangling first pointer into freed memory, and a sprayed next pointer hijacks later list walks. apply_constraints() then programs attacker-controlled bandwidth into interconnect hardware, giving a UAF write/control-flow primitive.

A:HAvailability impact, high

Walking LIST_POISON or a dangling req_node in aggregate_requests() or path_find() oopses or panics the kernel. Any use-after-free is High availability impact even when not fully turned into code execution.