CVE-2026-68332

A flaw was found in the airoha network driver within the Linux kernel. This vulnerability, a use-after-free, occurs because the airoha_ppe_deinit() function fails to properly synchronize memory deallocation with ongoing operations. An attacker could potentially exploit this to cause system instability or a denial of service.

This issue affects Airoha Ethernet SoCs with PPE offload. airoha_ppe_deinit() does not wait for RCU readers before freeing NPU. Systems without airoha hardware are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the airoha_eth module from loading. See https://access.redhat.com/solutions/41278 for instructions.