Look up another CVE · open CVE-2026-64563 in the interactive tracker

CVE-2026-64563

rhashtable: clear stale iter->p on table restart

7.8 EPSS 0.1% AV:L

Published 2026-08-04 (2 months ago) by the Linux kernel CNA. Subsystem lib. Debian urgency: not yet assigned.

What to do, per Debian release

Debian's own status for CVE-2026-64563 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	fixedDLA-4777-1 · 2026-09-08 · text	6.1.187-1	Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts.
Debian 13trixie	fixedDSA-6415-1 · 2026-08-06 · text	6.12.101-1	Update the kernel and reboot. DSA-6415-1 shipped the fix on 2026-08-06, in 6.12.101-1. A running kernel keeps the old code until the machine restarts.
Debian 14forky	fixed	7.1.6-1	Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.1.6-1	Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts.
Debian 12bookworm · linux-6.12	fixedDLA-4745-1 · 2026-08-18 · text	6.12.101-1~deb12u1	Update the kernel and reboot. DLA-4745-1 shipped the fix on 2026-08-18, in 6.12.101-1~deb12u1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

rhashtable_walk_start_check() has two restart paths when resuming a walk. When iter->walker.tbl is valid, it re-validates iter->p against the table and sets iter->p = NULL if the object is gone. When iter->walker.tbl is NULL (table was freed during resize), it resets slot and skip but forgets to clear iter->p. rhashtable_walk_next() then dereferences the stale iter->p, reading freed memory. This is a use-after-free. Any caller that does multi-fragment rhashtable walks across walk_stop/walk_start boundaries is affected. Concrete cases include netlink_diag (__netlink_diag_dump in net/netlink/diag.c) and TIPC (tipc_nl_sk_walk in net/tipc/socket.c). Crash stack (netlink_diag): BUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365/0x3c0 Read of size 8 at addr ffff88801a9d2438 (freed kmalloc-2k, offset 1080) Call Trace: rhashtable_walk_next+0x365/0x3c0 (lib/rhashtable.c:1016) __netlink_diag_dump+0x160/0x760 (net/netlink/diag.c:122) netlink_diag_dump+0xc2/0x240 netlink_dump+0x5bc/0x1270 netlink_recvmsg+0x7a3/0x980 sock_recvmsg+0x1bc/0x200 __sys_recvfrom+0x1d4/0x2c0

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

lib/rhashtable.c

What this is: RHASHTABLEMAINTAINERS section matched on lib/rhashtable.c · linux-crypto@vger.kernel.org · Maintained

Show whether Debian builds this, per release

Debian builds this code. Every release below compiles the affected file into the kernels it ships.

bookworm, trixie, forky, sid, bookworm · linux-6.12y

y: built into the kernel image on every flavour - only a patch removes it

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-08-04 (2 months ago)source
CVSS: 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it
Attack vector: local (AV:L)source
EPSS: 0.12%, higher than 1.6% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: not yet assignedsource
Subsystem: lib

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
4.18	5.10.265	ba510b5e9fe3
4.18	5.15.216	a0406c40c663
4.18	6.1.183	0955b65c2b47
4.18	6.6.151	c39643ad99fe
4.18	6.12.103	042fda5c0880
4.18	6.18.42	3ff7c1dbf722
4.18	7.1.6	4169d9fb92f3
4.18	7.2	8173f7e2ce67

Debian advisories

Advisory	Date	Shipped to	Debian
DLA-4777-1	2026-09-08	bookworm 6.1.187-1	tracker
DLA-4745-1	2026-08-18	bookworm 6.12.101-1~deb12u1	tracker
DSA-6415-1	2026-08-06	trixie 6.12.101-1	tracker

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local: Triggered via local netlink sock_diag dumps (e.g. netlink_diag over NETLINK_SOCK_DIAG) and similar local dump walkers such as TIPC_NL_SOCK_GET; not reachable from remote packet processing.
AC:LAttack complexity, low: Attacker controls both sides of the race by running a multi-fragment rhashtable dump while concurrently creating/destroying netlink (or TIPC) sockets to force table resize and free the walked object.
PR:LPrivileges required, low: An unprivileged local user can open NETLINK_SOCK_DIAG and dump without CAP_NET_ADMIN; CAP_NET_ADMIN is only required for SOCK_DESTROY, and TIPC_NL_SOCK_GET likewise has no admin permission flag.
UI:NUser interaction, none: Exploitation requires only attacker-issued syscalls (netlink dump plus concurrent socket churn); no victim action is needed.
S:UScope, unchanged: Impact is memory corruption within the host kernel authority (local privilege escalation/crash), not a cross-boundary escape such as guest-to-host or IOMMU bypass.
C:HConfidentiality impact, high: Use-after-free read of a freed hashed object (e.g. netlink_sock) can be reclaimed via heap spray, yielding an arbitrary read primitive through subsequent walk/diag use of the corrupted pointer.
I:HIntegrity impact, high: UAF on a reclaimable slab object enables heap spraying and fake-object injection into the walk path, which can be leveraged for arbitrary write or control-flow hijacking.
A:HAvailability impact, high: The demonstrated KASAN slab-use-after-free in rhashtable_walk_next can oops/panic the kernel, and UAFs remain crashable even when not fully exploited.