CVE-2026-64002: Linux Kernel Privilege Escalation Flaw

CVE-2026-64002 Overview

CVE-2026-64002 is a use-after-free vulnerability in the Linux kernel's IPv4 networking subsystem. The flaw resides in ipv4_sysctl_exit_net(), which frees net->ipv4.sysctl_local_reserved_ports before calling unregister_net_sysctl_table(). This premature deallocation creates a race window where concurrent threads accessing /proc/sys/net/ipv4/ip_local_reserved_ports can dereference freed memory. The vulnerability affects the network namespace exit path and is triggered during namespace teardown.

Critical Impact
Local attackers with low privileges can trigger memory corruption in kernel space, potentially leading to privilege escalation, information disclosure, or kernel denial of service through the sysctl interface.

Affected Products

Linux kernel (multiple stable branches referenced in upstream commits)
Distributions shipping vulnerable kernels using network namespaces
Systems exposing /proc/sys/net/ipv4/ip_local_reserved_ports sysctl

Discovery Timeline

2026-07-19 - CVE-2026-64002 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64002

Vulnerability Analysis

The vulnerability is a use-after-free condition in the IPv4 sysctl cleanup path of the Linux kernel. When a network namespace is being destroyed, ipv4_sysctl_exit_net() releases the memory backing net->ipv4.sysctl_local_reserved_ports before unregistering the sysctl table. Because unregister_net_sysctl_table() is the synchronization point that guarantees no other thread is executing inside the sysctl handlers, freeing the buffer earlier leaves a window in which concurrent readers or writers of /proc/sys/net/ipv4/ip_local_reserved_ports can access dangling memory.

Exploitation requires local access to the affected system and the ability to interact with network namespace teardown or sysctl entries. Successful triggering can corrupt kernel memory, disclose sensitive kernel data, or crash the host. The vulnerability affects confidentiality, integrity, and availability at the kernel level.

Root Cause

The root cause is an ordering defect in resource cleanup within ipv4_sysctl_exit_net(). The function must invoke unregister_net_sysctl_table() before releasing memory referenced by the sysctl handlers. Freeing sysctl_local_reserved_ports before deregistration violates this invariant, producing a classic use-after-free pattern where the lifetime of a shared buffer ends before all readers have been quiesced.

Attack Vector

The attack vector is local. An unprivileged or low-privileged local user can race a network namespace exit against a read or write of /proc/sys/net/ipv4/ip_local_reserved_ports. Environments that permit user-owned network namespaces (for example, containers or user-namespace-enabled sandboxes) expand the attack surface because unprivileged users can create and tear down namespaces on demand. No user interaction beyond the local process activity is required.

No verified public exploit code is available. Technical details of the fix are documented in the upstream kernel commits: Kernel Git Commit 155f90be and Kernel Git Commit ecf45080.

Detection Methods for CVE-2026-64002

Indicators of Compromise

Kernel oops or panic messages referencing ipv4_sysctl_exit_net, sysctl_local_reserved_ports, or unregister_net_sysctl_table in dmesg or /var/log/kern.log.
KASAN reports flagging use-after-free reads or writes in the IPv4 sysctl code path on instrumented kernels.
Unexpected process crashes or system instability correlated with heavy network namespace churn or container lifecycle events.

Detection Strategies

Monitor kernel ring buffer output for stack traces containing ipv4_sysctl_exit_net and reserved-port sysctl symbols.
Audit workloads that repeatedly create and destroy network namespaces, particularly container runtimes and sandboxing tools that expose user namespaces.
Track access patterns to /proc/sys/net/ipv4/ip_local_reserved_ports from non-administrative processes using auditd file-access rules.

Monitoring Recommendations

Enable and centralize kernel log collection to surface memory-corruption stack traces from Linux hosts.
Deploy runtime telemetry on Linux endpoints and containerized workloads to identify anomalous namespace creation rates or repeated sysctl reads.
Correlate kernel crash events with the running kernel version to prioritize hosts that lack the upstream fix.

How to Mitigate CVE-2026-64002

Immediate Actions Required

Apply the upstream kernel fix or the vendor-backported patch that reorders unregister_net_sysctl_table() before freeing net->ipv4.sysctl_local_reserved_ports.
Update to a distribution kernel that incorporates the referenced stable-tree commits, then reboot affected hosts to activate the fixed kernel.
Restrict the ability of unprivileged users to create user or network namespaces where operational requirements allow, reducing the local attack surface.

Patch Information

The fix is committed to the upstream stable kernel trees. Reference commits include 155f90be5ee8, 5b23a2ff379e, 6512c57c4638, 87a1e0fe7776, 8e59d4d0dcde, a0ffc6081a8b, a7f4eefb6e14, and ecf45080a4d3. Consult your distribution's security tracker for the exact package version containing the backport.

Workarounds

Disable unprivileged user namespaces via sysctl kernel.unprivileged_userns_clone=0 on distributions supporting this control to limit unprivileged namespace creation.
Restrict container runtime privileges and avoid granting CAP_NET_ADMIN or namespace creation capabilities to untrusted workloads.
Reduce exposure of /proc/sys/net/ipv4/ip_local_reserved_ports to non-root processes using appropriate mount and access controls.

bash

# Configuration example: reduce local attack surface until patched
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' >> /etc/sysctl.d/99-cve-2026-64002.conf

# Verify running kernel against distribution advisory
uname -r