CVE-2026-64376
MEDIUM 5.5 ALL-YEARSIn the Linux kernel, the following vulnerability has been resolved: firmware_loader: fix device reference leak in firmware_upload_register() firmware_upload_register() -> fw_create_instance() -> device_initialize() After fw_create_instance() succeeds, the lifetime of the embedded struct device is expected to be managed through the device core reference counting, since fw_create_instance() has already called device_initialize(). In firmware_upload_register(), if alloc_lookup_fw_priv() fails after fw_create_instance() succeeds, the code reaches free_fw_sysfs and frees fw_sysfs directly instead of releasing the device reference with put_device(). This may leave the reference count of the embedded struct device unbalanced, resulting in a refcount leak. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fix this by using put_device(fw_dev) in the failure path and letting fw_dev_release() handle the final cleanup, instead of freeing the instance directly from the error path.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.1%chance of exploitation in 30 days · 2nd percentile
Impact if exploited
5.5CVSS 3.1 · MEDIUM · NVD
- ConfidentialityNone
- IntegrityNone
- AvailabilityHigh
What an attacker needs
- ⚠Access: Requires local access to the host
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Weakness (CWE)
Not classified.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References and research data (JSON)
Vendor product assessments
Showing 32 of 274 vendor product statements; 242 omitted. Read the full vendor advisory.
kernel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel
- none available: Fix deferred
kernel-64k-modules as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-64k-modules
- none available: Fix deferred
kernel-debug-uki-virt as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-debug-uki-virt
- none available: Fix deferred
kernel-rt-64k-debug-devel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-debug-devel
- none available: Fix deferred
kernel-rt-debug-kvm as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-kvm
- none available: Fix deferred
kernel-uki-virt as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-uki-virt
- none available: Fix deferred
python3-perf as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/python3-perf
- none available: Fix deferred
kernel-64k-debug-modules-core as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-64k-debug-modules-core
- none available: Fix deferred
kernel-cross-headers as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-cross-headers
- none available: Fix deferred
kernel-devel as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-devel
- none available: Fix deferred
kernel-rt-64k-core as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-core
- none available: Fix deferred
kernel-rt-64k-devel-matched as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-devel-matched
- none available: Fix deferred
kernel-rt-debug-kvm as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-debug-kvm
- none available: Fix deferred
kernel-rt-modules-partner as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-modules-partner
- none available: Fix deferred
kernel-zfcpdump-devel-matched as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-zfcpdump-devel-matched
- none available: Fix deferred
rv as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/rv
- none available: Fix deferred
kernel as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel
Red Hat · CVE-2026-64376 · Updated 2026-09-08T23:08:12+00:00kernel-doc as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-doc
Red Hat · CVE-2026-64376 · Updated 2026-09-08T23:08:12+00:00perf as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/perf
Red Hat · CVE-2026-64376 · Updated 2026-09-08T23:08:12+00:00kernel-debug as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug
Red Hat · CVE-2026-64376 · Updated 2026-09-08T23:08:12+00:00kernel-kdump-devel as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-kdump-devel
Red Hat · CVE-2026-64376 · Updated 2026-09-08T23:08:12+00:00kernel-rt-doc as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-doc
Red Hat · CVE-2026-64376 · Updated 2026-09-08T23:08:12+00:00kernel-tools as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-tools
Red Hat · CVE-2026-64376 · Updated 2026-09-08T23:08:12+00:00bpftool as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/bpftool
Red Hat · CVE-2026-64376 · Updated 2026-09-08T23:08:12+00:00kernel-cross-headers as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-cross-headers
Red Hat · CVE-2026-64376 · Updated 2026-09-08T23:08:12+00:00kernel-debug-modules-internal as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug-modules-internal
Red Hat · CVE-2026-64376 · Updated 2026-09-08T23:08:12+00:00kernel-modules-extra as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-modules-extra
Red Hat · CVE-2026-64376 · Updated 2026-09-08T23:08:12+00:00kernel-rt-debug-devel as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-debug-devel
Red Hat · CVE-2026-64376 · Updated 2026-09-08T23:08:12+00:00kernel-rt-kvm as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-kvm
Red Hat · CVE-2026-64376 · Updated 2026-09-08T23:08:12+00:00kernel-selftests-internal as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-selftests-internal
Red Hat · CVE-2026-64376 · Updated 2026-09-08T23:08:12+00:00kernel-zfcpdump-devel as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-zfcpdump-devel
Red Hat · CVE-2026-64376 · Updated 2026-09-08T23:08:12+00:00python3-perf as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/python3-perf
Red Hat · CVE-2026-64376 · Updated 2026-09-08T23:08:12+00:00
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Linux | Linux Kernel | ≥ 5.19 and < 6.1.178 |
| Linux | Linux Kernel | ≥ 6.2 and < 6.6.145 |
| Linux | Linux Kernel | ≥ 6.7 and < 6.12.96 |
| Linux | Linux Kernel | ≥ 6.13 and < 6.18.39 |
| Linux | Linux Kernel | ≥ 6.19 and < 7.1.4 |
References
Patches & mitigations
- https://git.kernel.org/stable/c/517676ec7dfca064e08f94007a4abd21969de0a0 CVE record · Linux · Updated 2026-08-17T04:54:27.297Z
NVD · CVE-2026-64376 · Updated 2026-09-08T14:21:55.037 - https://git.kernel.org/stable/c/46d403da376a8b7c1187193294953816e1a8d7fe CVE record · Linux · Updated 2026-08-17T04:54:27.297Z
NVD · CVE-2026-64376 · Updated 2026-09-08T14:21:55.037 - https://git.kernel.org/stable/c/2619b47a0c8114eef980a56ade7e3ef4b58eb384 CVE record · Linux · Updated 2026-08-17T04:54:27.297Z
NVD · CVE-2026-64376 · Updated 2026-09-08T14:21:55.037 - https://git.kernel.org/stable/c/92f41769e5fd16bcd9ba97500d0517332e0a5b45 CVE record · Linux · Updated 2026-08-17T04:54:27.297Z
NVD · CVE-2026-64376 · Updated 2026-09-08T14:21:55.037 - https://git.kernel.org/stable/c/15432f19562fdb9199cce6d9fc24db12c71ed574 CVE record · Linux · Updated 2026-08-17T04:54:27.297Z
NVD · CVE-2026-64376 · Updated 2026-09-08T14:21:55.037 - https://git.kernel.org/stable/c/896df22ee57648b0c505bd76ddbc6b2341834696 CVE record · Linux · Updated 2026-08-17T04:54:27.297Z
NVD · CVE-2026-64376 · Updated 2026-09-08T14:21:55.037
Advisories
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64376.json Red Hat · CVE-2026-64376 · Updated 2026-09-08T23:08:12+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-48920 EUVD · EUVD-2026-48920
Technical & other
- https://access.redhat.com/security/cve/CVE-2026-64376 Red Hat · CVE-2026-64376 · Updated 2026-09-08T23:08:12+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2507205 Red Hat · CVE-2026-64376 · Updated 2026-09-08T23:08:12+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-64376 Red Hat · CVE-2026-64376 · Updated 2026-09-08T23:08:12+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-64376 Red Hat · CVE-2026-64376 · Updated 2026-09-08T23:08:12+00:00
- https://lore.kernel.org/linux-cve-announce/2026072524-CVE-2026-64376-efcf@gregkh/T Red Hat · CVE-2026-64376 · Updated 2026-09-08T23:08:12+00:00
Sources: NVD · CVE.org · All sources and attribution · EPSS