CVE-2026-64073

irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT

State: Published
Severity: 7.8 High
Published: Jul 19, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT

On PREEMPT_RT, non-HARD irq_work runs in per-CPU kthreads via run_irq_workd(), so irq_work_sync() uses rcuwait() to wait for BUSY==0.

After irq_work_single() clears BUSY via atomic_cmpxchg(), it still dereferences @work for irq_work_is_hard() and rcuwait_wake_up().

An irq_work_sync() caller on another CPU that enters after BUSY is cleared can observe BUSY==0 immediately, return, and free the work before those accesses complete — causing a use-after-free.

Fix this by wrapping run_irq_workd() in guard(rcu)() so that the entire irq_work_single() execution is within an RCU read-side critical section. Then add synchronize_rcu() in irq_work_sync() after rcuwait_wait_event() to ensure the caller waits for the RCU grace period before returning, preventing premature frees.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	810979682ccc98dbd83f341c18a2e556c30a7164 to before 2dc79362302922cb18f35e262712b5e58de65442Affected 810979682ccc98dbd83f341c18a2e556c30a7164 to before eef4f71b46a9929ac33e968538c9dd5d96a02460Affected 810979682ccc98dbd83f341c18a2e556c30a7164 to before 684a78183c54c23e70d1cba320f7fc184604210bAffected 810979682ccc98dbd83f341c18a2e556c30a7164 to before 18c0456ea2615b1a743a6db739c74411c3b42bc6Affected 810979682ccc98dbd83f341c18a2e556c30a7164 to before 81b582784518196eff1050212a046bc29d3a05ddAffected 810979682ccc98dbd83f341c18a2e556c30a7164 to before 91840be8f710370607f949a627e070896faeddb8Affected
LinuxLinux	5.16Affected before 5.16Not affected 6.1.175 through 6.1.Not affected 6.6.142 through 6.6.Not affected 6.12.92 through 6.12.Not affected 6.18.34 through 6.18.Not affected 7.0.11 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

810979682ccc98dbd83f341c18a2e556c30a7164 to before 2dc79362302922cb18f35e262712b5e58de65442Affected
810979682ccc98dbd83f341c18a2e556c30a7164 to before eef4f71b46a9929ac33e968538c9dd5d96a02460Affected
810979682ccc98dbd83f341c18a2e556c30a7164 to before 684a78183c54c23e70d1cba320f7fc184604210bAffected
810979682ccc98dbd83f341c18a2e556c30a7164 to before 18c0456ea2615b1a743a6db739c74411c3b42bc6Affected
810979682ccc98dbd83f341c18a2e556c30a7164 to before 81b582784518196eff1050212a046bc29d3a05ddAffected
810979682ccc98dbd83f341c18a2e556c30a7164 to before 91840be8f710370607f949a627e070896faeddb8Affected

LinuxLinux

5.16Affected
before 5.16Not affected
6.1.175 through 6.1.*Not affected
6.6.142 through 6.6.*Not affected
6.12.92 through 6.12.*Not affected
6.18.34 through 6.18.*Not affected
7.0.11 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.