CVE-2026-64073 Linux CVE debrief

Who should care

Linux kernel users and administrators, especially those using PREEMPT_RT, should be aware of this vulnerability and apply the necessary patches to prevent potential use-after-free errors.

Technical summary

The Linux kernel's irq_work_single() function on PREEMPT_RT is vulnerable to a use-after-free error. The function clears the BUSY flag using atomic_cmpxchg() but still accesses the @work structure for irq_work_is_hard() and rcuwait_wake_up(). If another CPU observes BUSY==0 and frees the work before these accesses complete, a use-after-free occurs. The fix involves wrapping run_irq_workd() in guard(rcu)() to ensure the entire irq_work_single() execution is within an RCU read-side critical section. Additionally, synchronize_rcu() is added in irq_work_sync() after rcuwait_wait_event() to ensure the caller waits for the RCU grace period before returning, preventing premature frees.

Defensive priority

High priority for Linux kernel maintainers and users, especially those using PREEMPT_RT, to apply the necessary patches and prevent potential use-after-free errors.

Recommended defensive actions

• Apply the official patch to update the Linux kernel's irq_work_single() function
• Review and update Linux kernel configurations to ensure PREEMPT_RT is properly handled
• Monitor Linux kernel updates and patches for future vulnerabilities
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-19T16:17:47.893Z and has not been modified since then. The NVD entry is currently Received. Linux kernel users should verify their deployments for potential exposure and review official advisories for affected scope and severity. Evidence is limited to public CVE and NVD details.

Official resources