CVE-2026-64188

In the Linux kernel, the following vulnerability has been resolved:

net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink()

rmnetdellink() removes the endpoint from the hash table with hlistdelinitrcu() and then immediately frees it with kfree(). However, RCU readers on the receive path (rmnetrxhandler -> _rmnetmapingresshandler) may still hold a reference to the endpoint and dereference ep->egressdev after the memory has been freed. The endpoint is a kmalloc-32 object, and the stale read at offset 8 corresponds to the egressdev pointer.

BUG: unable to handle page fault for address: ffffffffde942eef Oops: 0002 [#1] SMP NOPTI CPU: 1 UID: 0 PID: 137 Comm: pocwrite Not tainted 7.0.0+ #4 PREEMPTLAZY RIP: 0010:rmnetvndrxfixup (rmnet_vnd.c:27) Call Trace: <TASK> __rmnetmapingresshandler (rmnethandlers.c:48 rmnethandlers.c:101) rmnetrxhandler (rmnethandlers.c:129 rmnet_handlers.c:235) __netifreceiveskb_core.constprop.0 (net/core/dev.c:6096) _netifreceiveskbonecore (net/core/dev.c:6208) netifreceiveskb (net/core/dev.c:6467) tungetuser (drivers/net/tun.c:1955) tunchrwriteiter (drivers/net/tun.c:2003) vfswrite (fs/readwrite.c:688) ksyswrite (fs/readwrite.c:740) </TASK>

Add an rcuhead field to struct rmnetendpoint and replace kfree() with kfreercu() so the endpoint memory remains valid through the RCU grace period. Also remove the rmnetvnddellink() call and inline only the nrrmnetdevs decrement, since rmnetvnddellink() would set ep->egressdev to NULL during the grace period, creating a data race with lockless readers.