CVE-2026-64581 Linux CVE debrief

Who should care

Linux kernel users, administrators, and developers should be aware of this vulnerability and take necessary actions to protect their systems. They should review system logs for potential exploitation attempts, check for affected product deployments in managed environments, and apply the kernel patch that fixes the xfrm_user_policy function. Additionally, they should restrict access to the affected system to authorized users only and monitor system logs for potential exploitation attempts.

Technical summary

The xfrm_user_policy function in the Linux kernel is vulnerable to a use-after-free attack. This occurs due to a race condition between the transmit fast path, which resets the socket dst cache locklessly, and a per-socket policy change. If both sides observe the same old dst and each dst_release() it, the socket's single reference is dropped twice, resulting in a double-free of the xfrm_dst bundle while it is still referenced. The issue arises from a lack of atomicity in the sk_dst_reset() function, which can lead to a use-after-free vulnerability.

Defensive priority

High

Recommended defensive actions

• Apply the kernel patch that fixes the xfrm_user_policy function
• Restrict access to the affected system to authorized users only
• Monitor system logs for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is reachable by an unprivileged user via a user+network namespace. The issue has been resolved by using the atomic sk_dst_reset() function. To verify, defenders should review system logs for potential exploitation attempts and check for affected product deployments in managed environments. Additionally, they should confirm whether the kernel patch has been applied and validate the affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.