CVE-2026-81008
Description
A flaw was found in the Linux kernel's interconnect subsystem. When a dynamic memory allocation fails during path initialization, an object is prematurely freed while still being referenced in internal lists. This creates dangling pointers, which can be later accessed or modified. This use-after-free vulnerability can lead to system instability or a denial of service.
Statement
An interconnect path allocation error can leave dangling hlist entries because icc_get and of_icc_get_by_index free the path object directly after kasprintf failure even though path_init has already linked path requests into node request lists. A later icc_get or icc_set_bw can traverse or modify those stale list entries and trigger a slab use-after-free with a write to freed memory. For the CVSS the PR:L is used for the paranoid score because a local actor with access to debugfs fault injection delegated test interfaces or similar local control paths may be able to trigger the affected interconnect path without full host administration in some deployments. The issue is not network reachable and requires local execution or local control of a kernel facing test or device management path. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to kernel memory corruption.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
