CVE-2026-64163: Linux Kernel Kprobes DoS Vulnerability

CVE-2026-64163 Overview

CVE-2026-64163 is a Linux kernel defect in the test_kprobes KUnit self-test module. Running the kprobes sanity tests a second time causes every test in the suite to fail and can trigger a kernel paging fault. The root cause is stale state left in statically defined kprobe and kretprobe structures between test runs. The affected test harness lives in lib/tests/test_kprobes.c and is reachable through /sys/kernel/debug/kunit/kprobes_test/run. The issue was resolved upstream by moving cleanup logic into kprobes_test_init so that all probes are reset before each individual test.

Critical Impact
Repeated execution of the kprobes KUnit tests fails registration with -EINVAL and can cause an unrecoverable kernel paging request, resulting in a denial of service on the running kernel.

Affected Products

Linux kernel builds that include the test_kprobes KUnit module (CONFIG_KPROBES_SANITY_TEST)
Development and CI kernels exposing /sys/kernel/debug/kunit/kprobes_test/run
Stable branches referenced in the upstream fix commits published on kernel.org

Discovery Timeline

2026-07-19 - CVE-2026-64163 published to the National Vulnerability Database
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64163

Vulnerability Analysis

The test_kprobes module defines several kprobe and kretprobe instances as static variables. Static storage means those structures persist across invocations of the test suite. On the first run, register_kprobe and unregister_kprobe populate internal fields such as the resolved probe address and internal flag bits. When the tests exit, those fields are not reset.

On the second run, the test harness sets only symbol_name before calling register_kprobe. The kprobe core rejects the request with -EINVAL (-22) because leftover addr and flag values conflict with the symbol-based registration path. Once the test scaffolding continues past the failed registration, later operations dereference structures that reference freed or stale internal state, producing an "Unable to handle kernel paging request" oops.

The fix relocates all per-probe cleanup into kprobes_test_init, which KUnit invokes before every single test case. Clearing addr and flags guarantees each registration starts from a known state.

Root Cause

The defect is a state management error in test infrastructure classified as an Uninitialized Memory Use / stale state condition. Static kprobe objects retain post-registration bookkeeping between runs, violating the precondition required by register_kprobe when only symbol_name is provided.

Attack Vector

Exploitation requires local privileges sufficient to write to debugfs under /sys/kernel/debug/kunit/kprobes_test/run, which is normally restricted to root. A privileged local user or an automated CI job that runs the sanity tests twice can crash the kernel. The vulnerability is not reachable from unprivileged users, remote networks, or standard workloads that do not enable the KUnit kprobes test module.

Because no verified proof-of-concept code is published beyond the reproduction steps in the commit message, the vulnerability is described in prose. The reproduction is simply invoking echo 1 > /sys/kernel/debug/kunit/kprobes_test/run twice on a kernel built with the test module enabled.

Detection Methods for CVE-2026-64163

Indicators of Compromise

Kernel log entries containing test_kprobe: EXPECTATION FAILED at lib/tests/test_kprobes.c:64 after a repeat run of the kprobes KUnit test.
register_kprobe returning -22 (-EINVAL) for probes that succeeded on a prior run in the same boot session.
Kernel oops messages reporting Unable to handle kernel paging request originating from the kprobes test path.

Detection Strategies

Audit kernel build configurations for CONFIG_KPROBES_SANITY_TEST=y on production images where debug tests should not be shipped.
Monitor debugfs write activity targeting /sys/kernel/debug/kunit/kprobes_test/run through kernel audit rules.
Correlate kernel panic telemetry with preceding writes to KUnit test entry points to identify triggered instances.

Monitoring Recommendations

Ingest dmesg and /var/log/kern.log into a centralized log platform and alert on EXPECTATION FAILED combined with kprobes_test.
Track unexpected reboots on hosts that expose debugfs to non-standard users or CI runners.
Baseline which hosts have KUnit debug interfaces mounted and flag deviations from the approved inventory.

How to Mitigate CVE-2026-64163

Immediate Actions Required

Apply the upstream stable kernel updates referenced in the kernel.org commits that move probe cleanup into kprobes_test_init.
Disable CONFIG_KPROBES_SANITY_TEST in production kernel builds where the KUnit test surface is not required.
Restrict debugfs mounts to root-only access and unmount debugfs on hardened hosts.

Patch Information

The fix is distributed across the stable trees as commits 08d355936fcf, 1c24cf1fd67f, 96515819d79f, accc0004c501, and ef5581bb30ef. The patch clears addr and flags on every static kprobe and kretprobe inside kprobes_test_init so each test case starts from a clean state.

Workarounds

Avoid rerunning /sys/kernel/debug/kunit/kprobes_test/run within a single boot session on unpatched kernels.
Rebuild the kernel with CONFIG_KPROBES_SANITY_TEST disabled if patching is not immediately feasible.
Limit write permissions on /sys/kernel/debug to trusted administrative accounts and remove access for shared CI service users.

bash

# Configuration example: disable the KUnit kprobes sanity test in kernel .config
scripts/config --disable CONFIG_KPROBES_SANITY_TEST
make olddefconfig

# Restrict debugfs access on running systems
mount -o remount,mode=700 /sys/kernel/debug