CVE-2026-64188

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()

rmnet_dellink() removes the endpoint from the hash table with

hlist_del_init_rcu() and then immediately frees it with kfree(). However,

RCU readers on the receive path (rmnet_rx_handler ->

__rmnet_map_ingress_handler) may still hold a reference to the endpoint and

dereference ep->egress_dev after the memory has been freed. The endpoint is

a kmalloc-32 object, and the stale read at offset 8 corresponds to the

egress_dev pointer.

BUG: unable to handle page fault for address: ffffffffde942eef

Oops: 0002 [#1] SMP NOPTI

CPU: 1 UID: 0 PID: 137 Comm: poc_write Not tainted 7.0.0+ #4 PREEMPTLAZY

RIP: 0010:rmnet_vnd_rx_fixup (rmnet_vnd.c:27)

Call Trace:

<TASK>

__rmnet_map_ingress_handler (rmnet_handlers.c:48 rmnet_handlers.c:101)

rmnet_rx_handler (rmnet_handlers.c:129 rmnet_handlers.c:235)

__netif_receive_skb_core.constprop.0 (net/core/

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References