SB2026072050 - Improper control of a resource through its lifetime in Linux kernel tests

Description

This security bulletin contains information about 1 vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64163)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper state reset in lib/tests/test_kprobes.c when running the kprobes sanity tests multiple times. A local user can trigger repeated test runs to cause a denial of service.

The issue occurs because static kprobe and kretprobe objects retain leftover address and flag data between test runs, which leads to failed re-registration and an eventual kernel crash.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/08d355936fcf70c81c94f9fe7310450b65c53399
• https://git.kernel.org/stable/c/1c24cf1fd67f6702c719ab73499392cb7af956ae
• https://git.kernel.org/stable/c/96515819d79f356f40da5540968d838ea570fab9
• https://git.kernel.org/stable/c/accc0004c501a9918313142282b094d408af06fb
• https://git.kernel.org/stable/c/ef5581bb30efb939cc2bf093475c6cc85258e5cd