CVE-2026-81008

A flaw was found in the Linux kernel's interconnect subsystem. When a dynamic memory allocation fails during path initialization, an object is prematurely freed while still being referenced in internal lists. This creates dangling pointers, which can be later accessed or modified. This use-after-free vulnerability can lead to system instability or a denial of service.

An interconnect path allocation error can leave dangling hlist entries because icc_get and of_icc_get_by_index free the path object directly after kasprintf failure even though path_init has already linked path requests into node request lists. A later icc_get or icc_set_bw can traverse or modify those stale list entries and trigger a slab use-after-free with a write to freed memory. For the CVSS the PR:L is used for the paranoid score because a local actor with access to debugfs fault injection delegated test interfaces or similar local control paths may be able to trigger the affected interconnect path without full host administration in some deployments. The issue is not network reachable and requires local execution or local control of a kernel facing test or device management path. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to kernel memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.