Junglewise Threat Intelligence

CVE-2026-64103: Linux Kernel use-after-free in ISCI device removal path

CVE-2026-64103 · Severity: info · CVSS 5.5 · Published 2026-07-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Intel Storage Control Unit (ISCI) driver could allow a local user to cause a system crash. The issue occurs when a storage device is removed or the driver is unloaded, leading to a memory error known as a use-after-free. This primarily impacts system availability and stability.

Technical details

A use-after-free vulnerability exists in the Linux kernel ISCI (Intel C600 Series Chipset Storage Control Unit) driver within the device removal path. The root cause is a race condition where the completion tasklet is not properly killed before the host structure (ihost) is freed. Specifically, isci_host_deinit() fails to call tasklet_kill() after wait_for_stop(), allowing interrupt handlers to potentially requeue the tasklet and dereference freed memory (ihost->smu_registers). This can be triggered during device removal or module unloading. Patches have been released across multiple stable kernel branches to ensure tasklet_kill() is called after the scheduling source is quiesced.

Affected products

  • Linux Linux Kernel 6f231dda6808 to 1412995e10c7

Timeline

  • 2026-04-19: other: Patch authored
  • 2026-06-01: patched: Patch committed to stable tree
  • 2026-07-19: disclosed: CVE published

References

Related threats