Use After Free in Linux

CVE-2026-64221

In the Linux kernel, the following vulnerability has been resolved: spi: ti-qspi: fix use-after-free after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to clear the DMA channel pointer also if buffer allocation fails to avoid passing a pointer to the released channel to the DMA engine (or trying to free the channel a second time on late probe errors or driver unbind). This issue was flagged by Sashiko when reviewing a devres allocation conversion patch.

Vulnerability class: Use-After-Free

Published · last modified .

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.001 (2.3th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 2nd percentile — 2.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-64221: held from 0.002 to 0.001.

EPSS over last 30 days · oldest: 0.002 · newest: 0.001 · change: -0.000

Affected products

  • Linux — versions c687c46e9e4527c4b4d82bc3cca58c1b08bcfb83, 4.12, 0
  • Linux Kernel — versions 7.1

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-64221?
CVE-2026-64221 is a high-severity vulnerability in Linux, classified under Use After Free. CVSS score: 7.8/10. Published 2026-07-24.
How severe is CVE-2026-64221?
High severity. CVSS v3 base score is 7.8 out of 10.