Look up another CVE · open CVE-2026-64435 in the interactive tracker
CVE-2026-64435
audit: Fix data races of skb_queue_len() readers on audit_queue
Published 2026-07-25 (3 months ago) by the Linux kernel CNA. Subsystem kernel. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-64435 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4720-1 · 2026-08-05 · text | 6.1.180-1 | Update the kernel and reboot. DLA-4720-1 shipped the fix on 2026-08-05, in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.96-1 | Update the kernel and reboot. Fixed in 6.12.96-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.4-1 | Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.4-1 | Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4724-1 · 2026-08-07 · text | 6.12.100-1~deb12u1 | Update the kernel and reboot. DLA-4724-1 shipped the fix on 2026-08-07, in 6.12.100-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Multiple readers access audit_queue.qlen via skb_queue_len() without holding the queue lock or using READ_ONCE(), while kauditd writes to this field via the skb_dequeue() → __skb_unlink() path with WRITE_ONCE() protected by a spinlock. This constitutes data races. All affected skb_queue_len(&audit_queue) call sites: - kauditd_thread() wait_event_freezable() condition - audit_receive_msg() AUDIT_GET handler (s.backlog assignment) - audit_receive() backlog check - audit_log_start() backlog check and pr_warn() KCSAN reports the following conflicting access pattern (one example): ================================================================== BUG: KCSAN: data-race in audit_log_start / skb_dequeue write (marked) to 0xffffffff8512ee20 of 4 bytes by task 661 on cpu 57: skb_dequeue+0x70/0xf0 kauditd_send_queue+0x71/0x220 kauditd_thread+0x1cb/0x430 kthread+0x1c2/0x210 ret_from_fork+0x162/0x1a0 ret_from_fork_asm+0x1a/0x30 read to 0xffffffff8512ee20 of 4 bytes by task 36586 on cpu 1: audit_log_start+0x2a0/0x6b0 audit_core_dumps+0x64/0xa0 do_coredump+0x14b/0x1260 get_signal+0xeb2/0xf70 arch_do_signal_or_restart+0x41/0x170 exit_to_user_mode_loop+0xa2/0x1c0 do_syscall_64+0x1a3/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0xe0 value changed: 0x00000001 -> 0x00000000 ================================================================== Resolve the race by switching to lockless helper skb_queue_len_lockless(), which internally uses READ_ONCE() and properly pairs with the WRITE_ONCE() write accesses already present on the writer side. [PM: line length tweak]
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
kernel/audit.c
- What this is
- AUDIT SUBSYSTEMMAINTAINERS section matched on kernel/audit* · audit@vger.kernel.org · Supported
Check it on the machine
grep -w CONFIG_AUDIT /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sid, bookworm · linux-6.12y
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switch
- CONFIG_AUDIT
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-07-25 (3 months ago)source
- CVSS
- 8.2 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.33%, higher than 24.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- kernel
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.10 | 5.10.261 | 69f98fff30bd |
| 4.10 | 5.15.212 | b35597bdae1a |
| 4.10 | 6.1.178 | e575dabb8052 |
| 4.10 | 6.6.145 | 7ff42312ccde |
| 4.10 | 6.12.96 | a3d85dec60bb |
| 4.10 | 6.18.39 | fe997a84a385 |
| 4.10 | 7.1.4 | c5186201fa70 |
| 4.10 | 7.2 | c9a71daaecb2 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4724-1 | 2026-08-07 | bookworm 6.12.100-1~deb12u1 | tracker |
| DLA-4723-1 | 2026-08-07 | bullseye 6.1.180-1~deb11u1 | tracker |
| DLA-4720-1 | 2026-08-05 | bookworm 6.1.180-1 | tracker |
| DLA-4717-1 | 2026-08-05 | bullseye 5.10.262-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- Unauthenticated packets matching a pre-existing nftables audit-level logging or xtables AUDIT rule reach audit_log_start() through the network receive and netfilter paths.
- AC:LAttack complexity, low
- Parallel matching traffic invokes the vulnerable readers while feeding and waking kauditd, allowing the attacker to repeatedly drive both sides of the race.
- PR:NPrivileges required, none
- The audit rule must already be configured, but the remote attacker needs no credentials or capabilities to send matching packets.
- UI:NUser interaction, none
- No victim action is required after the affected network-audit configuration is active.
- S:UScope, unchanged
- The race and its effects remain within the host kernel and its audit security authority.
- C:NConfidentiality impact, none
- The raced value is only the 32-bit queue length; no pointer, packet contents, or adjacent memory is disclosed.
- I:LIntegrity impact, low
- An incorrect backlog decision can delay or discard audit records, causing limited corruption of the security audit trail without an arbitrary-write primitive.
- A:HAvailability impact, high
- In hardened systems using AUDIT_FAIL_PANIC, a raced queue length interpreted as exceeding the limit from the GFP_ATOMIC packet-audit path calls audit_log_lost() and can panic the kernel.