CVE-2026-64117 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should be aware of this vulnerability and take steps to mitigate it. Affected product deployments should be reviewed for exposure.

Technical summary

The vulnerability was caused by a use-after-free condition in the mac80211 subsystem of the Linux kernel. The ieee80211_invoke_fast_rx() function read RX status through IEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage that ieee80211_rx_mesh_data() reuses as IEEE80211_TX_INFO. To fix this, the rate from status was encoded before invoking ieee80211_rx_mesh_data(), ensuring that the RX_QUEUED arm consumes a value captured while status was still backed by valid memory. The fix was applied to the Linux kernel.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor Linux kernel updates and patches for future vulnerabilities
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The vulnerability was resolved by encoding the rate from status before invoking ieee80211_rx_mesh_data(). The fix was applied to the Linux kernel. This vulnerability was made public on 2026-07-19 and has not been modified since then. Evidence is limited to CVE and NVD details.

Official resources