Out-of-bounds read in Linux kernel - CVE-2026-64456

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU139487

Out-of-bounds read in Linux kernel - CVE-2026-64456

Published: July 27, 2026


Vulnerability identifier: #VU139487
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64456
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the virtio-rng driver copy_data() function when processing device-reported used.len values from a virtio-rng backend. A remote attacker can provide a specially crafted length value to disclose sensitive information.

The issue can leak adjacent guest-kernel slab contents through the guest RNG and can also be observed directly via /dev/hwrng. No guest userspace interaction is required for the initial out-of-bounds read to occur.


Affected software

Linux kernel
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
openEuler
Ubuntu
kernel-tools-debuginfo
bpftool-debuginfo
bpftool
kernel
kernel-debuginfo
kernel-debugsource
kernel-devel
kernel-source
kernel-tools
kernel-tools-devel
perf
perf-debuginfo
python2-perf
python2-perf-debuginfo
python3-perf
python3-perf-debuginfo
kernel-headers
kernel-extra-modules
kernel-64k-debug-devel-matched (Red Hat package)
kernel-rt-modules-extra (Red Hat package)
kernel-64k-debug-devel (Red Hat package)
rtla (Red Hat package)
kernel-zfcpdump-modules-extra (Red Hat package)
kernel-zfcpdump-modules-core (Red Hat package)
kernel-zfcpdump-modules (Red Hat package)
kernel-zfcpdump-devel-matched (Red Hat package)
kernel-zfcpdump-devel (Red Hat package)
kernel-zfcpdump-core (Red Hat package)
kernel-zfcpdump (Red Hat package)
python3-perf (Red Hat package)
perf (Red Hat package)
kernel-uki-virt-addons (Red Hat package)
kernel-uki-virt (Red Hat package)
kernel-tools-libs (Red Hat package)
kernel-tools (Red Hat package)
kernel-rt-64k-debug-modules-extra (Red Hat package)
libperf (Red Hat package)
kernel-tools-libs-devel (Red Hat package)
kernel-cross-headers (Red Hat package)
rv (Red Hat package)
kernel-rt-64k-modules-extra (Red Hat package)
kernel-rt-64k-modules-core (Red Hat package)
kernel-rt-64k-modules (Red Hat package)
kernel-rt-64k-devel (Red Hat package)
kernel-64k-devel (Red Hat package)
kernel-rt-64k-debug-modules-core (Red Hat package)
kernel-rt-64k-debug-modules (Red Hat package)
kernel-rt-64k-debug-devel (Red Hat package)
kernel-rt-64k-debug-core (Red Hat package)
kernel-rt-64k-debug (Red Hat package)
kernel-rt-64k-core (Red Hat package)
kernel-rt-64k (Red Hat package)
kernel-64k-devel-matched (Red Hat package)
kernel-rt-modules (Red Hat package)
kernel-debug (Red Hat package)
kernel-debug-core (Red Hat package)
kernel-debug-devel (Red Hat package)
kernel-debug-devel-matched (Red Hat package)
kernel-debug-modules (Red Hat package)
kernel-debug-modules-core (Red Hat package)
kernel-debug-modules-extra (Red Hat package)
kernel-debug-uki-virt (Red Hat package)
kernel-devel (Red Hat package)
kernel-devel-matched (Red Hat package)
kernel-headers (Red Hat package)
kernel-modules (Red Hat package)
kernel-modules-extra (Red Hat package)
kernel-rt-modules-core (Red Hat package)
kernel-rt-devel (Red Hat package)
kernel-rt-debug-modules-extra (Red Hat package)
kernel-rt-debug-modules-core (Red Hat package)
kernel-rt-debug-modules (Red Hat package)
kernel-rt-debug-devel (Red Hat package)
kernel-rt-debug-core (Red Hat package)
kernel-rt-debug (Red Hat package)
kernel-rt-core (Red Hat package)
kernel-rt (Red Hat package)
kernel-modules-extra-matched (Red Hat package)
kernel-modules-core (Red Hat package)
linux (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

How to mitigate CVE-2026-64456

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel-tools-debuginfo - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-327.0.0.228, 6.6.0-145.3.29.160
bpftool-debuginfo - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-327.0.0.228, 6.6.0-145.3.29.160
bpftool - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-327.0.0.228, 6.6.0-145.3.29.160
kernel - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-327.0.0.228, 6.6.0-145.3.29.160
kernel-debuginfo - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-327.0.0.228, 6.6.0-145.3.29.160
kernel-debugsource - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-327.0.0.228, 6.6.0-145.3.29.160
kernel-devel - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-327.0.0.228, 6.6.0-145.3.29.160
kernel-source - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-327.0.0.228, 6.6.0-145.3.29.160
kernel-tools - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-327.0.0.228, 6.6.0-145.3.29.160
kernel-tools-devel - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-327.0.0.228, 6.6.0-145.3.29.160
perf - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-327.0.0.228, 6.6.0-145.3.29.160
perf-debuginfo - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-327.0.0.228, 6.6.0-145.3.29.160
python2-perf - update to 4.19.90-2608.3.0.0385
python2-perf-debuginfo - update to 4.19.90-2608.3.0.0385
python3-perf - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-327.0.0.228, 6.6.0-145.3.29.160
python3-perf-debuginfo - addressed in versions 4.19.90-2608.3.0.0385, 5.10.0-327.0.0.228, 6.6.0-145.3.29.160
kernel-headers - addressed in versions 5.10.0-327.0.0.228, 6.6.0-145.3.29.160
kernel-extra-modules - update to 6.6.0-145.3.29.160
kernel-64k-debug-devel-matched (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt-modules-extra (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-64k-debug-devel (Red Hat package) - update to 6.12.0-211.56.1.el10_2
rtla (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-zfcpdump-modules-extra (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-zfcpdump-modules-core (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-zfcpdump-modules (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-zfcpdump-devel-matched (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-zfcpdump-devel (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-zfcpdump-core (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-zfcpdump (Red Hat package) - update to 6.12.0-211.56.1.el10_2
python3-perf (Red Hat package) - update to 6.12.0-211.56.1.el10_2
perf (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-uki-virt-addons (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-uki-virt (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-tools-libs (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-tools (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt-64k-debug-modules-extra (Red Hat package) - update to 6.12.0-211.56.1.el10_2
libperf (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-tools-libs-devel (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-cross-headers (Red Hat package) - update to 6.12.0-211.56.1.el10_2
rv (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt-64k-modules-extra (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt-64k-modules-core (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt-64k-modules (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt-64k-devel (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-64k-devel (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt-64k-debug-modules-core (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt-64k-debug-modules (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt-64k-debug-devel (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt-64k-debug-core (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt-64k-debug (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt-64k-core (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt-64k (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-64k-devel-matched (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt-modules (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-debug (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-debug-core (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-debug-devel (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-debug-devel-matched (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-debug-modules (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-debug-modules-core (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-debug-modules-extra (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-debug-uki-virt (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-devel (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-devel-matched (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-headers (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-modules (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-modules-extra (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt-modules-core (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt-devel (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt-debug-modules-extra (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt-debug-modules-core (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt-debug-modules (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt-debug-devel (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt-debug-core (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt-debug (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt-core (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-rt (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-modules-extra-matched (Red Hat package) - update to 6.12.0-211.56.1.el10_2
kernel-modules-core (Red Hat package) - update to 6.12.0-211.56.1.el10_2
linux (Ubuntu package) - addressed in versions 7.0.0-31.31, 7.0.0-31.31.1, 7.0.0-31.31~24.04.1, 7.0.0-1006.7, 7.0.0-1011.11~24.04.1, 7.0.0-1012.12, 7.0.0-1012.12~24.04.1
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1013.13

External References

Related Security Bulletins