{"id":"CVE-2026-46047","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: ns: Fix use-after-free in driver remove()\n\nIn the remove callback, if a packet arrives after destroy_workqueue() is\ncalled, but before sock_release(), the qr…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: ns: Fix use-after-free in driver remove()\n\nIn the remove callback, if a packet arrives after destroy_workqueue() is\ncalled, but before sock_release(), the qr…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 5.7, < 5.10.258","linux_kernel >= 5.11, < 5.15.209","linux_kernel >= 5.16, < 6.1.175","linux_kernel >= 6.2, < 6.6.140","linux_kernel >= 6.7, < 6.12.86","linux_kernel >= 6.13, < 6.18.27","linux_kernel >= 6.19, < 7.0.4"],"patched":["linux_kernel 7.0.4"],"published":"2026-05-27","updated":"2026-10-15","sourceUpdated":"2026-10-15T02:19:40.347","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46047","references":[{"url":"https://git.kernel.org/stable/c/0f313eb6a8f6dffa491373cf3afab979fa1c02f4","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2e127ceb1c415e246076d8e09e23e443a7a2038f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4ae0bd51bf7079e9c2a06b5de0ae04ba70d10167","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/65168712c216584ff482a7d1a67589f2079b2634","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7809fea20c9404bfcfa6112ec08d1fe1d3520beb","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/db3c60ec772de30acae92d560dfcc5258e58dbe8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dff081c3602f2fd810f69ef47945a226980dd05d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f96779e916576e81430ebb326baff6e433fef8ae","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00171,"epssPercentile":0.06029,"ingestedAt":"2026-10-15T03:30:12.883Z","slug":"CVE-2026-46047","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: ns: Fix use-after-free in driver remove()\n\nIn the remove callback, if a packet arrives after destroy_workqueue() is\ncalled, but before sock_release(), the qrtr_ns_data_ready() callback will\ntry to queue the work, causing use-after-free issue.\n\nFix this issue by saving the default 'sk_data_ready' callback during\nqrtr_ns_init() and use it to replace the qrtr_ns_data_ready() callback at\nthe start of remove(). This ensures that even if a packet arrives after\ndestroy_workqueue(), the work struct will not be dereferenced.\n\nNote that it is also required to ensure that the RX threads are completed\nbefore destroying the workqueue, because the threads could be using the\nqrtr_ns_data_ready() callback.\n\n## Affected\n\n- `linux_kernel >= 5.7, < 5.10.258`\n- `linux_kernel >= 5.11, < 5.15.209`\n- `linux_kernel >= 5.16, < 6.1.175`\n- `linux_kernel >= 6.2, < 6.6.140`\n- `linux_kernel >= 6.7, < 6.12.86`\n- `linux_kernel >= 6.13, < 6.18.27`\n- `linux_kernel >= 6.19, < 7.0.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.0.4`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}