PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64163 Linux CVE debrief

A vulnerability in the Linux kernel has been resolved. The kprobes sanity tests fail and eventually crash the kernel when run twice due to leftover data from previous test runs. The tests define several kprobes and kretprobes as static variables that are preserved across test runs. After register_kprobe and unregister_kprobe, a kprobe contains some leftover data that must be cleared before the kprobe can be registered again. The existing code clears some of the probes between subsequent tests, but not between two test runs. The leftover data from a previous test run makes the registrations fail in the next run.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-19
Original CVE updated
2026-07-19
Advisory published
2026-07-19
Advisory updated
2026-07-19

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should be aware of this vulnerability and take necessary actions to mitigate it. The vulnerability affects the Linux kernel and can cause kernel crashes when the kprobes sanity tests are run twice.

Technical summary

The kprobes sanity tests in the Linux kernel fail and crash the kernel when run twice due to leftover data from previous test runs. The tests define several kprobes and kretprobes as static variables that are preserved across test runs. After register_kprobe and unregister_kprobe, a kprobe contains some leftover data that must be cleared before the kprobe can be registered again. The issue is caused by the failure to clear the kprobes and kretprobes between test runs, leading to registration failures and kernel crashes.

Defensive priority

Medium

Recommended defensive actions

  • Review and apply the provided patches to clear kprobes between test runs.
  • Verify that the Linux kernel version is up-to-date with the latest security patches.
  • Run the kprobes sanity tests to ensure they pass without failures or crashes.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-07-19T16:17:58.327Z and has not been modified since then. The NVD entry is currently Received. The vulnerability affects the Linux kernel and is related to kprobes sanity tests. The tests fail and crash the kernel when run twice due to leftover data from previous test runs. The issue is caused by static variables that are preserved across test runs. The kprobes and kretprobes are not properly cleared between test runs, leading to registration failures and kernel crashes.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-19T16:17:58.327Z and has not been modified since then.