CVE-2026-64109 Linux CVE debrief

Who should care

Linux kernel developers, users who rely on the af_unix component for inter-process communication, and security teams responsible for vulnerability management and patching in Linux-based systems

Technical summary

The unix_stream_data_wait() function in the Linux kernel's af_unix component does not hold a lock that prevents SKBs on the sk_receive_queue from being dequeued and freed. This can lead to a use-after-free (UAF) read of tail->len. The issue was introduced in commit 79f632c71bea and has been fixed by removing the read of tail->len. The fix is not suitable for kernels before 6.5. Affected Linux kernel deployments should be reviewed for exposure and updated to a fixed version. Evidence limits suggest that further verification is needed to confirm affected scope and severity.

Defensive priority

High, as the vulnerability can lead to a UAF read of tail->len, potentially causing issues with inter-process communication in the af_unix component of the Linux kernel. Linux kernel developers and users who rely on the af_unix component for inter-process communication should review and apply the fix for the UAF vulnerability in the Linux kernel's af_unix component. Ensure that the Linux kernel is updated to a version that includes the fix. Monitor the Linux kernel's sk_receive_queue for potential issues. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Relevant monitoring, detection, and logs should be checked for exposed assets that need extra review. Exceptions should be tracked, and remediated assets should be retested, and the item should only be closed after evidence is documented. Asset inventory and source tracking are crucial in this process. Rollback change windows should be considered if necessary. Vendor patch guidance should be followed for updates. Exposure review is essential to identify potential vulnerabilities. The fix should be applied through normal change control where exposure is confirmed. Security teams should be aware of the vulnerability and its potential impact on the system. Linux kernel developers should review the commit history and apply the fix to affected versions. Evidence limits suggest that further verification is needed to confirm affected scope and severity. The fix should be suitable for the specific kernel version being used. Additional verification tasks may be required to ensure the fix is effective. Defensive verification tasks should be performed to validate the fix. The UAF vulnerability can be mitigated by applying the fix and ensuring that the Linux kernel is updated to a version that includes the fix. Compensating controls can be implemented to reduce the risk of the vulnerability. Monitoring and detection can help identify potential issues with the fix. Asset inventory and source tracking can help identify affected systems and ensure that they are updated with the fix. The fix should be applied to all affected systems to prevent exploitation of the UAF read.

Recommended defensive actions

• Review and apply the fix for the UAF vulnerability in the Linux kernel's af_unix component
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor the Linux kernel's sk_receive_queue for potential issues
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Perform asset inventory and source tracking to identify and update affected systems

Evidence notes

The vulnerability was introduced in commit 79f632c71bea and has been fixed by removing the read of tail->len. The fix is not suitable for kernels before 6.5. Linux kernel developers should review the commit history and apply the fix to affected versions. Evidence limits suggest that further verification is needed to confirm affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.