{"cve":"CVE-2026-46047","nvd":{"published":"2026-05-27T14:17:24.200","modified":"2026-10-15T02:19:40.347","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: ns: Fix use-after-free in driver remove()\n\nIn the remove callback, if a packet arrives after destroy_workqueue() is\ncalled, but before sock_release(), the qrtr_ns_data_ready() callback will\ntry to queue the work, causing use-after-free issue.\n\nFix this issue by saving the default 'sk_data_ready' callback during\nqrtr_ns_init() and use it to replace the qrtr_ns_data_ready() callback at\nthe start of remove(). This ensures that even if a packet arrives after\ndestroy_workqueue(), the work struct will not be dereferenced.\n\nNote that it is also required to ensure that the RX threads are completed\nbefore destroying the workqueue, because the threads could be using the\nqrtr_ns_data_ready() callback.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-416"],"references":["https://git.kernel.org/stable/c/0f313eb6a8f6dffa491373cf3afab979fa1c02f4","https://git.kernel.org/stable/c/2e127ceb1c415e246076d8e09e23e443a7a2038f","https://git.kernel.org/stable/c/4ae0bd51bf7079e9c2a06b5de0ae04ba70d10167","https://git.kernel.org/stable/c/65168712c216584ff482a7d1a67589f2079b2634","https://git.kernel.org/stable/c/7809fea20c9404bfcfa6112ec08d1fe1d3520beb"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:36:28.938604137+00:00"},"epss":{"cve":"CVE-2026-46047","score":0.00128,"percentile":0.02411,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}