CVE-2026-81008

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

interconnect: Fix use after free in icc_get() and of_icc_get_by_index()

In of_icc_get_by_index() and icc_get(), if the dynamic allocation for

path->name fails via kasprintf(), the error handling path directly

calls kfree(path) to free the path object and returns an error.

However, prior to this point, path_find() calls path_init(), which

already links the path's requests into the req_list of the respective

interconnect nodes via hlist_add_head(). Directly invoking kfree(path)

leaves dangling pointers in the hlist. A subsequent call to icc_get()

or icc_set_bw() will traverse or modify these corrupted lists, triggering

a slab use afterfree.

KASAN report showing the vulnerability when reproducing via debugfs:

BUG: KASAN: slab-use-after-free in path_find+0x6f8/0xcfc

Write of size 8 at addr fff000000d43f748 by task sh/1

...

Call trace:

kasan_report+0xac/0xfc

path_find+0x6f8/0xcfc

icc_get+0x148/0x380

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References