CVE-2026-64073

A flaw was found in the Linux kernel, specifically within the irq_work subsystem when running on systems configured with PREEMPT_RT. This vulnerability is a use-after-free, where the system attempts to access memory after it has been released. A local attacker could exploit this timing issue to cause a system crash, leading to a denial of service. In some scenarios, this type of flaw could potentially be leveraged for arbitrary code execution.

A use-after-free race exists in irq_work on PREEMPT_RT because irq_work_sync can observe that IRQ_WORK_BUSY is cleared and return while irq_work_single still dereferences the same work object. A caller on another CPU may then free the object before irq_work_single finishes using it, which can lead to a kernel crash and may create a kernel memory corruption condition. For the CVSS the PR:L is used for the paranoid score because reliable triggering normally requires local code execution through a kernel subsystem that exposes an irq_work lifetime to a local user or service, but does not require full administrator privileges in the worst defensible interpretation. The issue is not directly network reachable. Impact is at least local denial of service and in the worst case may allow confidentiality or integrity impact due to use-after-free memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.