{"id":"DEBIAN-CVE-2026-64582","details":"In the Linux kernel, the following vulnerability has been resolved:  RDMA/rxe: Fix a use-after-free problem in rxe_mmap  rxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list and releases pending_lock while the struct's kref is still at 1:     list_del_init(&ip-\u003epending_mmaps);    spin_unlock_bh(&rxe-\u003epending_lock);   /* ref == 1, no lock held */    ret = remap_vmalloc_range(vma, ip-\u003eobj, 0);  /* walks PTEs */    [...]    rxe_vma_open(vma);                    /* kref_get, ref → 2 */    remap_vmalloc_range_partial() walks PTEs without any lock.  A concurrent DESTROY_CQ ioctl on another CPU calls:      kref_put(&q-\u003eip-\u003eref, rxe_mmap_release)   /* ref 1→0 */     vfree(ip-\u003eobj)   /* clears vmalloc PTEs mid-walk */     kfree(ip)        /* frees rxe_mmap_info */  This yields:     1. Kernel crash, vmalloc_to_page() returns NULL when vfree wins the    per-PTE race -\u003e vm_insert_page(NULL) → GPF in validate_page_before_insert     2. Page UAF, vmalloc_to_page() reads a stale PTE before vfree clears    it. User VMA holds a PTE to a free'd page which might eventually get    reallocated later by vmalloc which allows the attacker to get a clean    page-level UAF.     It is worth noting that even though a page-level UAF is possible given    the strong primitive, it is statistically very difficult to achieve    given the very short time window (after the last insert_page and before    the kref_get).  The call trace are as below:    Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI   KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]   CPU: 0 UID: 1000 PID: 413 Comm: poc Not tainted 7.0.0-rc5-dirty #28 PREEMPT(lazy)   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014   RIP: 0010:validate_page_before_insert+0x32/0x300   Code: e5 41 57 41 56 49 89 fe 41 55 41 54 53 48 89 f3 e8 93 b5 a3 ff 48 8d 7b 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 7b 02 00 00 4c 8b 63 08 31 ff 4d 89 e5 41 83 e5   RSP: 0018:ffff88811b15f2f0 EFLAGS: 00000202   RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000   RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000008   RBP: ffff88811b15f318 R08: 0000000000000000 R09: 0000000000000000   R10: 0000000000000000 R11: 0000000000000000 R12: ffff8881181eee00   R13: 0000000000000000 R14: ffff8881181eee00 R15: ffff8881181eee20   FS:  00007b1e000f76c0(0000) GS:ffff8884268e0000(0000) knlGS:0000000000000000   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033   CR2: 00007b1e00a24ac0 CR3: 0000000116eb3000 CR4: 00000000000006f0   Call Trace:    \u003cTASK\u003e    insert_page+0x8f/0x190    ? __pfx_insert_page+0x10/0x10    ? kasan_save_alloc_info+0x38/0x60    vm_insert_page+0x2e7/0x400    remap_vmalloc_range_partial+0x212/0x3e0    remap_vmalloc_range+0x6e/0xb0    ? __kasan_check_write+0x14/0x30    rxe_mmap+0x2e9/0x5d0    ib_uverbs_mmap+0x1ad/0x2c0    __mmap_region+0x12c2/0x2ad0    ? __pfx___mmap_region+0x10/0x10    ? __sanitizer_cov_trace_switch+0x58/0xb0    ? mas_prev_slot+0x360/0x39c0    ? __sanitizer_cov_trace_switch+0x58/0xb0    ? mas_next_slot+0x1e5b/0x2f40    ? __sanitizer_cov_trace_cmp8+0x18/0x30    ? unmapped_area_topdown+0x4dd/0x610    ? kfree+0x1b1/0x440    ? free_cpumask_var+0x16/0x30    ? __kasan_slab_free+0x7d/0xa0    ? __sanitizer_cov_trace_cmp8+0x18/0x30    mmap_region+0x2e6/0x3c0    do_mmap+0xa3e/0x12a0    ? __pfx_do_mmap+0x10/0x10    ? __kasan_check_write+0x14/0x30    ? down_write_killable+0xba/0x160    ? __pfx_down_write_killable+0x10/0x10    ? __sanitizer_cov_trace_cmp4+0x16/0x30    vm_mmap_pgoff+0x2d4/0x4a0    ? __pfx_vm_mmap_pgoff+0x10/0x10    ? fget+0x1bf/0x270    ksys_mmap_pgoff+0x40c/0x690    ? __sanitizer_cov_trace_const_cmp4+0x16/0x30    ? __pfx_ksys_mmap_pgoff+0x10/0x10    ? __kasan_check_write+0x14/0x30    ? _raw_spin_trylock+0xbb/0x130    ? __pfx__raw_spin_trylock+0x10/0x10    __x64_sys_mmap+0x135/0x1e0    x64_sys_c ---truncated---","modified":"2026-09-14T17:03:22.669850741Z","published":"2026-08-05T12:18:57.440Z","upstream":["CVE-2026-64582"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-64582"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.187-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.135-1","6.1.137-1","6.1.139-1","6.1.140-1","6.1.147-1","6.1.148-1","6.1.153-1","6.1.158-1","6.1.159-1","6.1.162-1","6.1.164-1","6.1.170-1","6.1.170-2","6.1.170-3","6.1.172-1","6.1.174-1","6.1.176-1","6.1.177-1","6.1.180-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-64582.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.100-1"}]}],"versions":["6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-64582.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.5-1"}]}],"versions":["6.12.100-1","6.12.101-1","6.12.105-1","6.12.107-1","6.12.38-1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.57-1","6.12.57-1~bpo12+1","6.12.63-1","6.12.63-1~bpo12+1","6.12.69-1","6.12.69-1~bpo12+1","6.12.73-1","6.12.73-1~bpo12+1","6.12.74-1","6.12.74-2","6.12.74-2~bpo12+1","6.12.85-1","6.12.85-1~bpo12+1","6.12.86-1","6.12.86-1~bpo12+1","6.12.88-1","6.12.88-1~bpo12+1","6.12.90-1","6.12.90-1~bpo12+1","6.12.90-2","6.12.90-2~bpo12+1","6.12.94-1","6.12.94-1~bpo12+1","6.12.95-1","6.12.95-1~bpo12+1","6.12.96-1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.10-1","6.16.11-1","6.16.12-1","6.16.12-1~bpo13+1","6.16.12-2","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16.6-1","6.16.7-1","6.16.8-1","6.16.9-1","6.16~rc7-1~exp1","6.17.10-1","6.17.11-1","6.17.12-1","6.17.13-1","6.17.13-1~bpo13+1","6.17.2-1~exp1","6.17.5-1~exp1","6.17.6-1","6.17.7-1","6.17.7-2","6.17.8-1","6.17.8-1~bpo13+1","6.17.9-1","6.18.1-1~exp1","6.18.10-1","6.18.12-1","6.18.12-1~bpo13+1","6.18.13-1","6.18.14-1","6.18.15-1","6.18.15-1~bpo13+1","6.18.2-1~exp1","6.18.3-1","6.18.5-1","6.18.5-1~bpo13+1","6.18.8-1","6.18.9-1","6.18.9-1~bpo13+1","6.18~rc4-1~exp1","6.18~rc4-1~exp2","6.18~rc5-1~exp1","6.18~rc6-1~exp1","6.18~rc7-1~exp1","6.19-1~exp1","6.19.10-1","6.19.10-1~bpo13+1","6.19.11-1","6.19.11-1~bpo13+1","6.19.12-1","6.19.13-1","6.19.13-1~bpo13+1","6.19.14-1","6.19.14-1~bpo13+1","6.19.2-1~exp1","6.19.3-1~exp1","6.19.4-1~exp1","6.19.5-1~exp1","6.19.6-1","6.19.6-2","6.19.6-2~bpo13+1","6.19.8-1","6.19.8-1~bpo13+1","6.19~rc4-1~exp1","6.19~rc5-1~exp1","6.19~rc6-1~exp1","6.19~rc7-1~exp1","6.19~rc8-1~exp1","7.0-1~exp1","7.0.1-1~exp1","7.0.10-1","7.0.10-1~bpo13+1","7.0.12-1","7.0.12-2","7.0.12-2~bpo13+1","7.0.13-1","7.0.13-1~bpo13+1","7.0.14-1","7.0.3-1","7.0.4-1","7.0.4-1~bpo13+1","7.0.7-1","7.0.7-1~bpo13+1","7.0.9-1","7.0.9-1~bpo13+1","7.1.1-1~exp1","7.1.2-1~exp1","7.1.3-1","7.1.3-1+sunvdc","7.1.3-1~bpo13+1","7.1.4-1","7.1~rc2-1~exp1","7.1~rc3-1~exp1","7.1~rc4-1~exp1","7.1~rc4-1~exp2","7.1~rc5-1~exp1","7.1~rc7-1~exp1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-64582.json"}},{"package":{"name":"linux-6.12","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux-6.12?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.100-1~deb12u1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-64582.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}