CVE-2026-64117 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should be aware of this vulnerability and take steps to mitigate it. Affected product deployments should be reviewed for exposure.

Technical summary

The vulnerability was caused by a use-after-free condition in the mac80211 subsystem of the Linux kernel. The ieee80211_invoke_fast_rx() function read RX status through IEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage that ieee80211_rx_mesh_data() reuses as IEEE80211_TX_INFO. To fix this, the rate from status was encoded before invoking ieee80211_rx_mesh_data(), ensuring that the RX_QUEUED arm consumes a value captured while status was still backed by valid memory. The fix was applied to the Linux kernel.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor Linux kernel updates and patches for future vulnerabilities
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The vulnerability was resolved by encoding the rate from status before invoking ieee80211_rx_mesh_data(). The fix was applied to the Linux kernel. This vulnerability was made public on 2026-07-19 and has not been modified since then. Evidence is limited to CVE and NVD details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.