CVE-2026-64025 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, BPF and ktls users, and organizations relying on Linux kernel-based systems should be aware of this vulnerability and apply the fix to prevent potential use-after-free issues. They should review and update BPF and ktls configurations to ensure proper synchronization and monitor Linux kernel updates and patches for potential related vulnerabilities.

Technical summary

The Linux kernel vulnerability (CVE-2026-64025) is caused by a missing guard in sk_psock_verdict_data_ready(), which can lead to a use-after-free when a socket is inserted into a sockmap before TLS RX is configured. The fix ensures that if a TLS RX context is present, psock->saved_data_ready is called to wake recv() waiters and return immediately, leaving the receive queue untouched. This issue affects Linux kernel developers and maintainers, BPF and ktls users, and organizations relying on Linux kernel-based systems.

Defensive priority

High priority for Linux kernel developers and maintainers to apply the fix and prevent potential use-after-free issues.

Recommended defensive actions

• Apply the fix to the Linux kernel to prevent use-after-free issues.
• Review and update BPF and ktls configurations to ensure proper synchronization.
• Monitor Linux kernel updates and patches for potential related vulnerabilities.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-07-19T16:17:42.527Z and has not been modified since then. The NVD entry is currently Received. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the official advisory. The fix applies the same guard as sk_psock_strp_data_ready(): if a TLS RX context is present, call psock->saved_data_ready (sock_def_readable) to wake recv() waiters and return immediately, leaving the receive queue untouched.

Official resources