CVE-2026-64435: Linux Kernel Race Condition Vulnerability

CVE-2026-64435 Overview

CVE-2026-64435 is a data race vulnerability in the Linux kernel audit subsystem. Multiple readers access audit_queue.qlen via skb_queue_len() without holding the queue lock or using READ_ONCE(). The kauditd writer thread updates the same field via skb_dequeue() → __skb_unlink() using WRITE_ONCE() under a spinlock. This mismatch produces concurrent unsynchronized accesses that the Kernel Concurrency Sanitizer (KCSAN) flags as data races.

Critical Impact
The race affects kernel audit logging paths reachable during signal handling, core dumps, and system-call auditing, and can lead to inconsistent queue-length observations that impact availability of the audit pipeline.

Affected Products

Linux kernel (audit subsystem, kernel/audit.c)
Distributions shipping affected upstream kernel versions prior to the referenced stable patches
Systems relying on kauditd for audit event delivery

Discovery Timeline

2026-07-25 - CVE-2026-64435 published to the National Vulnerability Database (NVD)
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64435

Vulnerability Analysis

The Linux kernel audit subsystem maintains a shared queue, audit_queue, that buffers audit records before kauditd forwards them to userspace. The writer path in kauditd_thread() removes entries via skb_dequeue(), which internally invokes __skb_unlink() and updates audit_queue.qlen using WRITE_ONCE() under a spinlock. Multiple reader call sites, however, read the same field with a plain skb_queue_len() call and no synchronization.

The unsynchronized reads occur in kauditd_thread() (the wait_event_freezable() condition), the AUDIT_GET handler in audit_receive_msg(), the backlog check in audit_receive(), and both the backlog check and pr_warn() invocation in audit_log_start(). KCSAN reports a concrete conflict where audit_log_start() observed qlen transitioning from 0x00000001 to 0x00000000 mid-read while skb_dequeue() executed on another CPU.

The fix replaces the racy readers with skb_queue_len_lockless(), which uses READ_ONCE() and correctly pairs with the writer's WRITE_ONCE() semantics.

Root Cause

The root cause is a torn-read data race between plain-C reads of audit_queue.qlen and a WRITE_ONCE()-based writer. Without READ_ONCE(), the compiler is permitted to reload or split the read, producing values that never existed atomically in memory. This falls under the race condition class of defects and violates the kernel memory model requirements for concurrent access.

Attack Vector

The race is reachable from any kernel path that generates audit records, including system call auditing, audit_core_dumps() during signal-driven core dump handling, and userspace netlink requests to the audit subsystem. A local unprivileged process can drive audit traffic by triggering audited syscalls or signals, increasing the likelihood of observing a torn read. Sustained exploitation can produce inconsistent backlog accounting, spurious pr_warn() output, or missed wakeups in kauditd_thread() that degrade audit event delivery.

No verified public exploit code is available. See the upstream commits for technical details: Kernel Patch 69f98fff and Kernel Patch c9a71daa.

Detection Methods for CVE-2026-64435

Indicators of Compromise

KCSAN reports naming audit_log_start and skb_dequeue in the conflicting stacks on instrumented kernels
Unexpected audit: backlog limit exceeded warnings emitted from pr_warn() under normal load
Stalled or delayed audit record delivery from kauditd to auditd in userspace
Kernel version strings matching pre-patch commits listed in the upstream references

Detection Strategies

Inventory running kernels and compare build hashes against the fixed commits (69f98fff, 7ff42312, a3d85dec, b35597bd, c5186201, c9a71daa, e575dabb, fe997a84)
Monitor dmesg and /var/log/kern.log for KCSAN data-race reports involving audit_queue
Track audit daemon health metrics such as dropped records, backlog size, and kauditd wakeups

Monitoring Recommendations

Forward kernel logs and auditd telemetry to a centralized analytics platform for anomaly detection on audit pipeline gaps
Alert on abnormal drops in audit event volume from Linux hosts that historically produce steady traffic
Correlate host patch state with kernel package inventory to surface unpatched systems

How to Mitigate CVE-2026-64435

Immediate Actions Required

Apply the upstream kernel patches referenced in the NVD entry as soon as vendor builds are available
Prioritize patching hosts that run heavy audit workloads or forward audit data to compliance pipelines
Verify the audit subsystem remains functional after patching by confirming auditctl -s reports expected backlog behavior

Patch Information

The fix switches racy readers to skb_queue_len_lockless(), which uses READ_ONCE() and pairs correctly with the existing WRITE_ONCE() writer. Fixed upstream commits include Kernel Patch 69f98fff, Kernel Patch 7ff42312, Kernel Patch a3d85dec, Kernel Patch b35597bd, Kernel Patch c5186201, Kernel Patch c9a71daa, Kernel Patch e575dabb, and Kernel Patch fe997a84.

Workarounds

No supported workaround eliminates the race; only kernel patching resolves the defect
Reduce audit backlog pressure by tuning audit_backlog_limit and rate-limiting rules to lower the probability of triggering the race path
Restrict local user access on multi-tenant systems until patched kernels are deployed

bash

# Verify running kernel version and audit backlog state after patch
uname -r
auditctl -s | grep -E 'backlog|lost'
# Example tuning to reduce backlog pressure prior to patching
auditctl -b 16384