CVE-2026-64563 Linux CVE debrief

Who should care

Linux kernel developers and users, network administrators, and security teams responsible for managing Linux-based systems should be aware of this vulnerability. They should review the affected scope, assess potential impact, and plan for vendor-supported updates or mitigations. Additionally, operators of systems using the affected Linux kernel versions should prioritize patching and verify the effectiveness of compensating controls for exposed systems while remediation is scheduled and verified. Vulnerability management and security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Platform administrators should also assess the vulnerability's impact on their environments and prioritize remediation efforts accordingly. Security teams should monitor relevant monitoring, detection, and logs for exposed assets that need extra review. Asset inventory management should also be reviewed to identify potentially affected systems. Rollback and change window planning should consider the potential impact of this vulnerability on business operations. Source tracking and verification of patch deployment should be performed to ensure the vulnerability is properly mitigated. Compensating controls should be evaluated for effectiveness in preventing exploitation. The vulnerability management process should be updated to include this vulnerability and ensure timely remediation. Security awareness training should be provided to educate users about the potential risks associated with this vulnerability. Compliance and regulatory requirements should be reviewed to ensure adherence to industry standards for vulnerability management and patch management. Business continuity planning should consider the potential impact of this vulnerability on critical systems and services. Incident response planning should be updated to include procedures for responding to potential exploitation of this vulnerability. Communication plans should be developed to inform stakeholders about the vulnerability and remediation efforts. Training and exercise programs should be updated to include this vulnerability and ensure that personnel are able

Technical summary

The rhashtable_walk_start_check function has two restart paths when resuming a walk. When iter->walker.tbl is valid, it re-validates iter->p against the table and sets iter->p = NULL if the object is gone. However, when iter->walker.tbl is NULL (table was freed during resize), it resets slot and skip but forgets to clear iter->p. The rhashtable_walk_next function then dereferences the stale iter->p, reading freed memory.

Defensive priority

High

Recommended defensive actions

• Apply the kernel patch that fixes the use-after-free vulnerability in rhashtable.
• Restrict access to the affected system to prevent potential exploitation.
• Monitor system logs for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by a use-after-free error in the rhashtable_walk_next function. This function can be called across walk_stop/walk_start boundaries, affecting multiple fragment rhashtable walks. The issue arises when the rhashtable_walk_start_check function fails to clear the stale iter->p pointer, leading to a potential crash or code execution. To verify, defenders should review system logs for suspicious activity and monitor for potential exploitation attempts.

Official resources