GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-81008 (GCVE-0-2026-81008)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-14 11:59
VLAI
Title
interconnect: Fix use after free in icc_get() and of_icc_get_by_index()
Summary
In the Linux kernel, the following vulnerability has been resolved: interconnect: Fix use after free in icc_get() and of_icc_get_by_index() In of_icc_get_by_index() and icc_get(), if the dynamic allocation for path->name fails via kasprintf(), the error handling path directly calls kfree(path) to free the path object and returns an error. However, prior to this point, path_find() calls path_init(), which already links the path's requests into the req_list of the respective interconnect nodes via hlist_add_head(). Directly invoking kfree(path) leaves dangling pointers in the hlist. A subsequent call to icc_get() or icc_set_bw() will traverse or modify these corrupted lists, triggering a slab use afterfree. KASAN report showing the vulnerability when reproducing via debugfs: BUG: KASAN: slab-use-after-free in path_find+0x6f8/0xcfc Write of size 8 at addr fff000000d43f748 by task sh/1 ... Call trace: kasan_report+0xac/0xfc path_find+0x6f8/0xcfc icc_get+0x148/0x380 icc_get_set+0xf8/0x2d0 ... Freed by task 1: kfree+0x1a0/0x4a4 icc_get+0x2cc/0x380 icc_get_set+0xf8/0x2d0 Fix this by replacing kfree(path) with the proper teardown function, icc_put(path), which safely removes the requests from the req_list using hlist_del() and drops the provider usage references before freeing the memory. Additionally, in icc_get(), ensure that the icc_lock mutex is released prior to calling icc_put(path) to avoid a deadlock, as icc_put() internally acquires the same lock.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3791163602f7140011a8dc1691cfe6ec0cb1ef07 , < 03c3af594dea9196cf6ca70d914b42aa8c873c35 (git)
Affected: 3791163602f7140011a8dc1691cfe6ec0cb1ef07 , < d4d73decdb9a44a248b1cbd04ed6f334df544d9c (git)
Affected: 3791163602f7140011a8dc1691cfe6ec0cb1ef07 , < 9a671125d4228357e5b929733c4593d27a273749 (git)
Affected: 3791163602f7140011a8dc1691cfe6ec0cb1ef07 , < fedea72e8f312fe7d0c6cb19353e61d2d5643b11 (git)
Affected: 3791163602f7140011a8dc1691cfe6ec0cb1ef07 , < a4e9aa7907ade87d1d96853d14e05dcf682f8363 (git)
Affected: 3791163602f7140011a8dc1691cfe6ec0cb1ef07 , < db8147c5d5ad2cfa21c2be566f95981b41b05de6 (git)
Affected: 3791163602f7140011a8dc1691cfe6ec0cb1ef07 , < d715d19cfcfe99f361adb05cefc143a95d400b87 (git)
Affected: 3791163602f7140011a8dc1691cfe6ec0cb1ef07 , < 25c7e242aca084fdc1098248194032317dca625d (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.6
Unaffected: 0 , < 5.6 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/interconnect/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "03c3af594dea9196cf6ca70d914b42aa8c873c35",
              "status": "affected",
              "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07",
              "versionType": "git"
            },
            {
              "lessThan": "d4d73decdb9a44a248b1cbd04ed6f334df544d9c",
              "status": "affected",
              "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07",
              "versionType": "git"
            },
            {
              "lessThan": "9a671125d4228357e5b929733c4593d27a273749",
              "status": "affected",
              "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07",
              "versionType": "git"
            },
            {
              "lessThan": "fedea72e8f312fe7d0c6cb19353e61d2d5643b11",
              "status": "affected",
              "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07",
              "versionType": "git"
            },
            {
              "lessThan": "a4e9aa7907ade87d1d96853d14e05dcf682f8363",
              "status": "affected",
              "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07",
              "versionType": "git"
            },
            {
              "lessThan": "db8147c5d5ad2cfa21c2be566f95981b41b05de6",
              "status": "affected",
              "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07",
              "versionType": "git"
            },
            {
              "lessThan": "d715d19cfcfe99f361adb05cefc143a95d400b87",
              "status": "affected",
              "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07",
              "versionType": "git"
            },
            {
              "lessThan": "25c7e242aca084fdc1098248194032317dca625d",
              "status": "affected",
              "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/interconnect/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninterconnect: Fix use after free in icc_get() and of_icc_get_by_index()\n\nIn of_icc_get_by_index() and icc_get(), if the dynamic allocation for\npath-\u003ename fails via kasprintf(), the error handling path directly\ncalls kfree(path) to free the path object and returns an error.\n\nHowever, prior to this point, path_find() calls path_init(), which\nalready links the path\u0027s requests into the req_list of the respective\ninterconnect nodes via hlist_add_head(). Directly invoking kfree(path)\nleaves dangling pointers in the hlist. A subsequent call to icc_get()\nor icc_set_bw() will traverse or modify these corrupted lists, triggering\na slab use afterfree.\n\nKASAN report showing the vulnerability when reproducing via debugfs:\n\n  BUG: KASAN: slab-use-after-free in path_find+0x6f8/0xcfc\n  Write of size 8 at addr fff000000d43f748 by task sh/1\n  ...\n  Call trace:\n   kasan_report+0xac/0xfc\n   path_find+0x6f8/0xcfc\n   icc_get+0x148/0x380\n   icc_get_set+0xf8/0x2d0\n  ...\n  Freed by task 1:\n   kfree+0x1a0/0x4a4\n   icc_get+0x2cc/0x380\n   icc_get_set+0xf8/0x2d0\n\nFix this by replacing kfree(path) with the proper teardown function,\nicc_put(path), which safely removes the requests from the req_list using\nhlist_del() and drops the provider usage references before freeing the\nmemory.\n\nAdditionally, in icc_get(), ensure that the icc_lock mutex is released\nprior to calling icc_put(path) to avoid a deadlock, as icc_put()\ninternally acquires the same lock."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The interconnect core is an on-chip SoC bandwidth API. of_icc_get_by_index() runs from local consumer-driver probe (Qualcomm GPU, venus/camera, UFS, USB, OPP on Android/embedded) and icc_get() from the optional debugfs test client; no network or adjacent protocol handler reaches this code.\nAC:L - Once kasprintf() fails after path_init() has linked path-\u003ereqs into node req_lists, the dangling hlist pointers persist and the next icc_set_bw()/path_find() is a deterministic UAF, not a race. A local attacker can force the GFP_KERNEL name allocation to fail with memory pressure and retry via driver rebind, module load, or deferred probe.\nPR:L - After the error path plants dangling req_list entries, an ordinary local/Android user triggers the UAF through icc_set_bw() via V4L2, DRM render nodes, or block I/O on already-probed consumers that share interconnect nodes. of_icc_get() itself runs from consumer probe/rebind whose privilege gating is ambiguous, so Low applies.\nUI:N - The attacker induces memory pressure and device activity (or a rebind/probe) from their own process. No separate victim action such as mounting a filesystem or opening a file is required.\nS:U - The UAF corrupts kernel heap objects and interconnect provider state in the host kernel. This is standard kernel privilege escalation and does not cross a VM, IOMMU, or sandbox security boundary.\nC:H - This is a slab use-after-free of struct icc_path whose embedded icc_req hlist nodes remain on node-\u003ereq_list. aggregate_requests() and the interconnect debugfs summary read enabled/tag/avg_bw/peak_bw and r-\u003edev from the freed object, so heap reuse yields an arbitrary kernel read primitive.\nI:H - path_find() hlist_add_head() performs an 8-byte write through the dangling first pointer into freed memory, and a sprayed next pointer hijacks later list walks. apply_constraints() then programs attacker-controlled bandwidth into interconnect hardware, giving a UAF write/control-flow primitive.\nA:H - Walking LIST_POISON or a dangling req_node in aggregate_requests() or path_find() oopses or panics the kernel. Any use-after-free is High availability impact even when not fully turned into code execution."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:59:41.755Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/03c3af594dea9196cf6ca70d914b42aa8c873c35"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4d73decdb9a44a248b1cbd04ed6f334df544d9c"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a671125d4228357e5b929733c4593d27a273749"
        },
        {
          "url": "https://git.kernel.org/stable/c/fedea72e8f312fe7d0c6cb19353e61d2d5643b11"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4e9aa7907ade87d1d96853d14e05dcf682f8363"
        },
        {
          "url": "https://git.kernel.org/stable/c/db8147c5d5ad2cfa21c2be566f95981b41b05de6"
        },
        {
          "url": "https://git.kernel.org/stable/c/d715d19cfcfe99f361adb05cefc143a95d400b87"
        },
        {
          "url": "https://git.kernel.org/stable/c/25c7e242aca084fdc1098248194032317dca625d"
        }
      ],
      "title": "interconnect: Fix use after free in icc_get() and of_icc_get_by_index()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-81008",
    "datePublished": "2026-09-11T19:42:59.405Z",
    "dateReserved": "2026-08-26T14:34:25.812Z",
    "dateUpdated": "2026-09-14T11:59:41.755Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-81008",
      "date": "2026-09-17",
      "epss": "0.00159",
      "percentile": "0.05509"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/interconnect/core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "03c3af594dea9196cf6ca70d914b42aa8c873c35",
                    "status": "affected",
                    "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d4d73decdb9a44a248b1cbd04ed6f334df544d9c",
                    "status": "affected",
                    "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9a671125d4228357e5b929733c4593d27a273749",
                    "status": "affected",
                    "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fedea72e8f312fe7d0c6cb19353e61d2d5643b11",
                    "status": "affected",
                    "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a4e9aa7907ade87d1d96853d14e05dcf682f8363",
                    "status": "affected",
                    "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "db8147c5d5ad2cfa21c2be566f95981b41b05de6",
                    "status": "affected",
                    "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d715d19cfcfe99f361adb05cefc143a95d400b87",
                    "status": "affected",
                    "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "25c7e242aca084fdc1098248194032317dca625d",
                    "status": "affected",
                    "version": "3791163602f7140011a8dc1691cfe6ec0cb1ef07",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/interconnect/core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.6"
                  },
                  {
                    "lessThan": "5.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninterconnect: Fix use after free in icc_get() and of_icc_get_by_index()\n\nIn of_icc_get_by_index() and icc_get(), if the dynamic allocation for\npath-\u003ename fails via kasprintf(), the error handling path directly\ncalls kfree(path) to free the path object and returns an error.\n\nHowever, prior to this point, path_find() calls path_init(), which\nalready links the path\u0027s requests into the req_list of the respective\ninterconnect nodes via hlist_add_head(). Directly invoking kfree(path)\nleaves dangling pointers in the hlist. A subsequent call to icc_get()\nor icc_set_bw() will traverse or modify these corrupted lists, triggering\na slab use afterfree.\n\nKASAN report showing the vulnerability when reproducing via debugfs:\n\n  BUG: KASAN: slab-use-after-free in path_find+0x6f8/0xcfc\n  Write of size 8 at addr fff000000d43f748 by task sh/1\n  ...\n  Call trace:\n   kasan_report+0xac/0xfc\n   path_find+0x6f8/0xcfc\n   icc_get+0x148/0x380\n   icc_get_set+0xf8/0x2d0\n  ...\n  Freed by task 1:\n   kfree+0x1a0/0x4a4\n   icc_get+0x2cc/0x380\n   icc_get_set+0xf8/0x2d0\n\nFix this by replacing kfree(path) with the proper teardown function,\nicc_put(path), which safely removes the requests from the req_list using\nhlist_del() and drops the provider usage references before freeing the\nmemory.\n\nAdditionally, in icc_get(), ensure that the icc_lock mutex is released\nprior to calling icc_put(path) to avoid a deadlock, as icc_put()\ninternally acquires the same lock."
          }
        ],
        "id": "CVE-2026-81008",
        "lastModified": "2026-09-14T13:18:55.183",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:19:09.560",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/03c3af594dea9196cf6ca70d914b42aa8c873c35"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/25c7e242aca084fdc1098248194032317dca625d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9a671125d4228357e5b929733c4593d27a273749"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a4e9aa7907ade87d1d96853d14e05dcf682f8363"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d4d73decdb9a44a248b1cbd04ed6f334df544d9c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d715d19cfcfe99f361adb05cefc143a95d400b87"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/db8147c5d5ad2cfa21c2be566f95981b41b05de6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fedea72e8f312fe7d0c6cb19353e61d2d5643b11"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T21:01:53+00:00",
      "cve": "CVE-2026-81008",
      "id": "CVE-2026-81008",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "185",
      "product_status:known_not_affected": "91",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: interconnect: Fix use after free in icc_get() and of_icc_get_by_index()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81008.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:04:10Z",
      "cve": "CVE-2026-81008",
      "id": "CVE-2026-81008",
      "initial_release_date": "2026-09-12T16:35:42Z",
      "product_status:known_affected": "126",
      "product_status:known_not_affected": "227",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-81008",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-81008.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.