Improper control of a resource through its lifetime in Linux kernel - CVE-2026-64579
Published: August 6, 2026
Vulnerability identifier: #VU141029
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64579
CWE-ID: CWE-664
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper state management in xfrm_hash_rebuild() in the xfrm policy subsystem when rebuilding policy hashes under memory pressure. A local user can trigger policy reinsertions that take the allocating inexact insertion path and cause a kernel crash.
The issue is reachable under memory pressure and can be triggered deterministically with failslab.
Affected software
Linux kernel
How to mitigate CVE-2026-64579
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/6aa3796d18a9fda953ad76a62b57bf6c145cb9ef
- https://git.kernel.org/stable/c/7acc5ed2f33608a3d83b64f50a5766843b6e2485
- https://git.kernel.org/stable/c/94c00391a5117530188334f740ce26d3f1256190
- https://git.kernel.org/stable/c/d9d9cc21cc90014724a14c447e3d587be9447107
- https://git.kernel.org/stable/c/f38f8cce2f7e79775b3db7e8a5eacda04ac908e4