CVE-2026-64188

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()<br /> <br /> rmnet_dellink() removes the endpoint from the hash table with<br /> hlist_del_init_rcu() and then immediately frees it with kfree(). However,<br /> RCU readers on the receive path (rmnet_rx_handler -&gt;<br /> __rmnet_map_ingress_handler) may still hold a reference to the endpoint and<br /> dereference ep-&gt;egress_dev after the memory has been freed. The endpoint is<br /> a kmalloc-32 object, and the stale read at offset 8 corresponds to the<br /> egress_dev pointer.<br /> <br /> BUG: unable to handle page fault for address: ffffffffde942eef<br /> Oops: 0002 [#1] SMP NOPTI<br /> CPU: 1 UID: 0 PID: 137 Comm: poc_write Not tainted 7.0.0+ #4 PREEMPTLAZY<br /> RIP: 0010:rmnet_vnd_rx_fixup (rmnet_vnd.c:27)<br /> Call Trace:<br /> <br /> __rmnet_map_ingress_handler (rmnet_handlers.c:48 rmnet_handlers.c:101)<br /> rmnet_rx_handler (rmnet_handlers.c:129 rmnet_handlers.c:235)<br /> __netif_receive_skb_core.constprop.0 (net/core/dev.c:6096)<br /> __netif_receive_skb_one_core (net/core/dev.c:6208)<br /> netif_receive_skb (net/core/dev.c:6467)<br /> tun_get_user (drivers/net/tun.c:1955)<br /> tun_chr_write_iter (drivers/net/tun.c:2003)<br /> vfs_write (fs/read_write.c:688)<br /> ksys_write (fs/read_write.c:740)<br /> <br /> <br /> Add an rcu_head field to struct rmnet_endpoint and replace kfree() with<br /> kfree_rcu() so the endpoint memory remains valid through the RCU grace<br /> period. Also remove the rmnet_vnd_dellink() call and inline only the<br /> nr_rmnet_devs decrement, since rmnet_vnd_dellink() would set<br /> ep-&gt;egress_dev to NULL during the grace period, creating a data race<br /> with lockless readers.