CVE-2026-64189 Linux CVE debrief

Who should care

Linux kernel users and administrators should be aware of this vulnerability and take steps to mitigate it. Affected operators, platforms, and security teams should review the official advisory and assess their exposure. Vulnerability management and security teams should prioritize patching or mitigating this vulnerability.

Technical summary

The vulnerability is caused by a race condition between the dump path and the ip_set_create() function. The dump path reads the array using ip_set_ref_netlink(), which is a plain rcu_dereference_raw() of the array pointer. This allows a concurrent ip_set_create() to grow the array, publish the new array, call synchronize_net(), and then kvfree() the old one. To fix this vulnerability, take rcu_read_lock() around the array load, matching ip_set_get_byname() and __ip_set_put_byindex().

Defensive priority

High

Recommended defensive actions

• Apply the patch to fix the vulnerability
• Use a supported Linux kernel version
• Monitor for suspicious activity
• Use a firewall to restrict access to the affected system
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was reported by an unknown vendor and has a CVSS score of 7.8. The NVD entry is currently Received. Linux kernel users and administrators should verify their systems for exposure and review the official advisory for affected scope and severity. Evidence is limited, and defenders should review context and track exceptions.

Official resources