CVE-2026-64115 Linux CVE debrief

Who should care

Linux kernel users and administrators should be aware of this vulnerability and ensure they have applied the necessary patches to prevent exploitation. This includes verifying the Linux kernel version and applying the patch if necessary. Additionally, system administrators should monitor system logs for potential exploitation attempts and review compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

The CVE-2026-64115 vulnerability was caused by the incorrect handling of peer RST packets during the vsock/vmci connection handshake process. The patch fixes this issue by returning an error when an unexpected packet type is received, preventing a UAF condition. The vulnerability was introduced due to the incorrect return value of vmci_transport_recv_connecting_server() for a peer RST packet. The fix involves treating peer RST like any other unexpected packet type, which prevents the UAF condition and ensures that the pending socket is removed from the listener's pending_links synchronously.

Defensive priority

High

Recommended defensive actions

• Apply the patch to update the Linux kernel
• Verify the Linux kernel version and apply the patch if necessary
• Monitor system logs for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE-2026-64115 vulnerability was resolved by treating peer RST like any other unexpected packet type. The patch was tested on lts-6.12.79 with KASAN, showing 52/100 unpatched failures reduced to 0/100 patched failures. The fix involves synchronously removing the pending socket from the listener's pending_links, preventing a use-after-free condition. Defenders should verify their Linux kernel versions and apply the necessary patches to prevent exploitation.

Official resources