CVE-2026-64563: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64563 Overview

CVE-2026-64563 is a use-after-free vulnerability in the Linux kernel's rhashtable implementation. The flaw resides in rhashtable_walk_start_check(), which fails to clear the stale iter->p pointer when the underlying table has been freed during a resize. A subsequent call to rhashtable_walk_next() dereferences this dangling pointer, reading freed kernel memory.

The vulnerability affects any caller performing multi-fragment rhashtable walks across walk_stop and walk_start boundaries. Confirmed impacted subsystems include netlink_diag (__netlink_diag_dump in net/netlink/diag.c) and TIPC (tipc_nl_sk_walk in net/tipc/socket.c).

Critical Impact
A KASAN-confirmed slab use-after-free in the kernel rhashtable walker can be triggered from unprivileged netlink socket operations, enabling potential information disclosure or kernel memory corruption.

Affected Products

Linux kernel versions containing the vulnerable rhashtable_walk_start_check() restart logic
Kernel subsystems using rhashtable walks with walk_stop/walk_start, including netlink_diag
TIPC socket enumeration via tipc_nl_sk_walk

Discovery Timeline

2026-08-04 - CVE-2026-64563 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-64563

Vulnerability Analysis

The Linux kernel's rhashtable provides a resizable hash table used broadly by networking subsystems. Iteration is performed with an rhashtable_iter structure that tracks the current table (iter->walker.tbl), slot, skip counter, and last returned object (iter->p). Callers commonly pause iteration with rhashtable_walk_stop() and resume it with rhashtable_walk_start() to release RCU read locks between fragments of a dump.

rhashtable_walk_start_check() contains two restart paths. When iter->walker.tbl remains valid, the function re-validates iter->p against the current table and clears it to NULL if the referenced object is gone. When iter->walker.tbl is NULL because the table was freed during a concurrent resize, the function resets the slot and skip counters but does not clear iter->p. The stale pointer references a previously freed object.

On the next call to rhashtable_walk_next(), the walker dereferences iter->p to compute the next entry, reading freed slab memory. KASAN captures this as a slab-use-after-free in rhashtable_walk_next+0x365/0x3c0 at lib/rhashtable.c:1016.

Root Cause

The defect is a missing state-clearing step in the second restart branch of rhashtable_walk_start_check(). Both restart paths must invalidate iter->p when the previously observed object cannot be re-anchored in the current table, but only the first path does so. This is a use-after-free rooted in incomplete iterator state reset.

Attack Vector

An unprivileged local user can trigger the code path by opening a NETLINK_SOCK_DIAG socket and issuing a socket dump via recvfrom() while concurrent workloads cause rhashtable resizes. The dumper repeatedly stops and restarts the walk to yield RCU, providing the window in which the tracked table is freed and iter->p becomes stale. TIPC socket enumeration through tipc_nl_sk_walk exposes an equivalent path.

The observable crash from the disclosure report follows this call chain:

BUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365/0x3c0
Read of size 8 at addr ffff88801a9d2438 (freed kmalloc-2k, offset 1080)
Call Trace:
 rhashtable_walk_next+0x365/0x3c0   (lib/rhashtable.c:1016)
 __netlink_diag_dump+0x160/0x760    (net/netlink/diag.c:122)
 netlink_diag_dump+0xc2/0x240
 netlink_dump+0x5bc/0x1270
 netlink_recvmsg+0x7a3/0x980
 sock_recvmsg+0x1bc/0x200
 __sys_recvfrom+0x1d4/0x2c0

Detection Methods for CVE-2026-64563

Indicators of Compromise

KASAN reports naming rhashtable_walk_next with a slab-use-after-free read against a kmalloc-2k allocation
Kernel oops or panic traces originating from __netlink_diag_dump or tipc_nl_sk_walk
Unexpected termination of ss, sock_diag consumers, or TIPC utilities coinciding with kernel warnings

Detection Strategies

Enable KASAN on test and canary kernels to catch the use-after-free during fuzzing of NETLINK_SOCK_DIAG and TIPC dumps
Correlate dmesg kernel warnings with process-level telemetry showing frequent recvfrom() calls on AF_NETLINK sockets bound to NETLINK_SOCK_DIAG
Compare running kernel build identifiers against distribution advisories referencing commits 3ff7c1d, 4169d9f, and 8173f7e

Monitoring Recommendations

Ingest /var/log/kern.log and journalctl -k output into a centralized log store and alert on KASAN or Oops entries referencing rhashtable_walk_next
Track processes performing large-scale socket enumeration under non-root UIDs, particularly against hosts with heavy connection churn that drives rhashtable resizes
Monitor kernel package versions across fleets to identify hosts still running pre-patch builds

How to Mitigate CVE-2026-64563

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 3ff7c1d, 4169d9f, and 8173f7e or the equivalent distribution security update
Reboot affected hosts after updating the kernel package so the fixed image is loaded
Inventory hosts running custom or long-lived kernel builds to confirm the fix is present in rhashtable_walk_start_check()

Patch Information

The fix clears iter->p in the restart branch that handles a freed walker table, aligning both restart paths so no stale object pointer survives across walk_stop/walk_start. Reference patches are available from the stable kernel tree: Kernel Git Commit 3ff7c1d, Kernel Git Commit 4169d9f, and Kernel Git Commit 8173f7e.

Workarounds

Restrict access to NETLINK_SOCK_DIAG where feasible by tightening capabilities and seccomp profiles for untrusted workloads
Disable or unload the TIPC module on hosts that do not require it to remove the tipc_nl_sk_walk exposure
Limit container and multi-tenant workloads from opening arbitrary AF_NETLINK sockets via Kubernetes PodSecurity or AppArmor policies until patches are deployed

bash

# Verify running kernel and confirm the patched commit is present
uname -r
zcat /proc/config.gz | grep CONFIG_KASAN

# Blocklist the TIPC module on systems that do not need it
echo 'blacklist tipc' | sudo tee /etc/modprobe.d/blacklist-tipc.conf
sudo modprobe -r tipc 2>/dev/null || true