Executive brief
A vulnerability was identified in the Linux kernel's interrupt handling mechanism when using the Real-Time (PREEMPT_RT) configuration. This flaw could allow a local attacker to cause a system crash or unpredictable behavior by triggering a 'use-after-free' condition during specific internal task synchronizations. While primarily affecting system stability, it represents a risk to the availability of real-time industrial or embedded systems.
Technical details
A use-after-free vulnerability exists in kernel/irq_work.c within the irq_work_single() function when running on PREEMPT_RT enabled kernels. The root cause is a race condition where irq_work_single() clears the BUSY flag via atomic_cmpxchg() but continues to dereference the work structure for irq_work_is_hard() and rcuwait_wake_up() calls. A concurrent caller of irq_work_sync() on another CPU may observe the cleared BUSY flag, return, and subsequently free the work object before the original thread finishes its accesses. The fix involves wrapping run_irq_workd() in an RCU read-side critical section and adding synchronize_rcu() to irq_work_sync() to ensure all accesses complete before the memory is freed.
Affected products
- Linux Linux 5.16 to 6.18.34
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory
References
- https://git.kernel.org/stable/c/18c0456ea2615b1a743a6db739c74411c3b42bc6
- https://git.kernel.org/stable/c/2dc79362302922cb18f35e262712b5e58de65442
- https://git.kernel.org/stable/c/684a78183c54c23e70d1cba320f7fc184604210b
- https://git.kernel.org/stable/c/81b582784518196eff1050212a046bc29d3a05dd
- https://git.kernel.org/stable/c/91840be8f710370607f949a627e070896faeddb8
- https://git.kernel.org/stable/c/eef4f71b46a9929ac33e968538c9dd5d96a02460