{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-81008",
  "modified": "2026-10-07T17:22:01Z",
  "upstream": [
    "CVE-2026-81008"
  ],
  "published": "2026-09-11T19:47:07Z",
  "summary": "interconnect: Fix use after free in icc_get() and of_icc_get_by_index()",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ninterconnect: Fix use after free in icc_get() and of_icc_get_by_index()\n\nIn of_icc_get_by_index() and icc_get(), if the dynamic allocation for\npath->name fails via kasprintf(), the error handling path directly\ncalls kfree(path) to free the path object and returns an error.\n\nHowever, prior to this point, path_find() calls path_init(), which\nalready links the path's requests into the req_list of the respective\ninterconnect nodes via hlist_add_head(). Directly invoking kfree(path)\nleaves dangling pointers in the hlist. A subsequent call to icc_get()\nor icc_set_bw() will traverse or modify these corrupted lists, triggering\na slab use afterfree.\n\nKASAN report showing the vulnerability when reproducing via debugfs:\n\n  BUG: KASAN: slab-use-after-free in path_find+0x6f8/0xcfc\n  Write of size 8 at addr fff000000d43f748 by task sh/1\n  ...\n  Call trace:\n   kasan_report+0xac/0xfc\n   path_find+0x6f8/0xcfc\n   icc_get+0x148/0x380\n   icc_get_set+0xf8/0x2d0\n  ...\n  Freed by task 1:\n   kfree+0x1a0/0x4a4\n   icc_get+0x2cc/0x380\n   icc_get_set+0xf8/0x2d0\n\nFix this by replacing kfree(path) with the proper teardown function,\nicc_put(path), which safely removes the requests from the req_list using\nhlist_del() and drops the provider usage references before freeing the\nmemory.\n\nAdditionally, in icc_get(), ensure that the icc_lock mutex is released\nprior to calling icc_put(path) to avoid a deadlock, as icc_put()\ninternally acquires the same lock.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.188",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81008"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/03c3af594dea9196cf6ca70d914b42aa8c873c35"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d4d73decdb9a44a248b1cbd04ed6f334df544d9c"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/9a671125d4228357e5b929733c4593d27a273749"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/fedea72e8f312fe7d0c6cb19353e61d2d5643b11"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a4e9aa7907ade87d1d96853d14e05dcf682f8363"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/db8147c5d5ad2cfa21c2be566f95981b41b05de6"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d715d19cfcfe99f361adb05cefc143a95d400b87"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/25c7e242aca084fdc1098248194032317dca625d"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-09-14T12:06:03Z"
  }
}