CVE-2026-81008

The Linux kernel's interconnect (ICC) framework contains a slab use-after-free in icc_get() and of_icc_get_by_index(): when the kasprintf() allocation for path->name fails, the error path calls kfree(path) on a path object whose requests were already linked into interconnect nodes' req_list via hlist_add_head(), leaving dangling hlist pointers behind. A later call to icc_get() or icc_set_bw() that traverses or modifies those corrupted lists triggers a kernel slab use-after-free, as confirmed by the KASAN report reproduced via debugfs. Exploitation requires local code execution plus the ability to force the allocation to fail (e.g., through induced kernel memory pressure), but successful corruption of these kernel linked lists could plausibly be developed into privilege escalation — consistent with the CVSS 3.1 score of 7.8 (AV:L/PR:L, high impact to confidentiality, integrity, and availability). Affected systems are those running a kernel containing the buggy interconnect code, which is most relevant to ARM/ARM64 SoC-based platforms (smartphones, tablets, and embedded Linux devices) that actually use the interconnect framework. No public proof of concept is known and the flaw is not listed in CISA's KEV catalog.

What to do: Upgrade to a kernel containing the fix, which replaces kfree(path) with icc_put(path) (safely removing requests from the req_list and dropping provider references) and releases the icc_lock mutex before teardown to avoid deadlock. Android and embedded vendors should pull the fix into their device trees and ship updated kernels. Because exploitation requires local access combined with a forced allocation failure, prioritize patching multi-user or otherwise high-risk hosts, and watch kernel logs for KASAN slab-use-after-free reports in path_find()/icc_get() as an indicator of attempted abuse.