CVE-2026-64073

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT<br /> <br /> On PREEMPT_RT, non-HARD irq_work runs in per-CPU kthreads via<br /> run_irq_workd(), so irq_work_sync() uses rcuwait() to wait for BUSY==0.<br /> <br /> After irq_work_single() clears BUSY via atomic_cmpxchg(), it still<br /> dereferences @work for irq_work_is_hard() and rcuwait_wake_up().<br /> <br /> An irq_work_sync() caller on another CPU that enters after BUSY is cleared<br /> can observe BUSY==0 immediately, return, and free the work before those<br /> accesses complete — causing a use-after-free.<br /> <br /> Fix this by wrapping run_irq_workd() in guard(rcu)() so that the entire<br /> irq_work_single() execution is within an RCU read-side critical<br /> section. Then add synchronize_rcu() in irq_work_sync() after<br /> rcuwait_wait_event() to ensure the caller waits for the RCU grace period<br /> before returning, preventing premature frees.