CVE-2026-68181

A flaw was found in the Linux kernel's mei bus component. A use-after-free vulnerability exists in the mei_cl_bus_dev_release() function. This flaw, caused by improper synchronization during cleanup, could lead to memory corruption and system instability.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploiting it requires local system access and precise timing to trigger a race condition during device cleanup. The flaw is confined to systems with Intel Management Engine Interface hardware where MEI bus client devices are actively unbound or removed. In standard enterprise deployments lacking Intel ME hardware or where MEI devices are not dynamically deregistered, the potential attack surface is significantly limited.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.