CVE-2026-64579: Linux Kernel Privilege Escalation Flaw

CVE-2026-64579 Overview

CVE-2026-64579 is a Linux kernel vulnerability in the IPsec transformation (xfrm) policy subsystem. The flaw resides in xfrm_hash_rebuild() inside net/xfrm/xfrm_policy.c, where an inverted guard condition causes the preallocation loop to prepare bins for exact policies while skipping inexact ones. When the reinsert loop later processes inexact policies, it must allocate memory under GFP_ATOMIC, and any allocation failure leaves a poisoned bydst node in place. A subsequent rebuild dereferences LIST_POISON2 through hlist_del_rcu(), triggering a general protection fault and kernel panic.

Critical Impact
The bug enables a deterministic kernel crash reachable under memory pressure, producing a denial-of-service condition on hosts running IPsec workloads.

Affected Products

Linux kernel (mainline xfrm policy subsystem in net/xfrm/xfrm_policy.c)
Stable kernel branches receiving the fix commits 6aa3796d18a9, 7acc5ed2f336, 94c00391a511, d9d9cc21cc90, and f38f8cce2f7e
Systems using IPsec policies with prefixlen < threshold (inexact policies)

Discovery Timeline

2026-08-05 - CVE-2026-64579 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-64579

Vulnerability Analysis

The defect lives in xfrm_hash_rebuild(), the workqueue handler that rebuilds the IPsec policy hash tables when configuration thresholds change. The function uses a two-pass design: the first pass preallocates every bin and chain the second pass will need, so the reinsert pass, executed after hlist_del_rcu(), cannot allocate and cannot fail. This invariant is what keeps the RCU-protected list consistent while entries are moved.

The guard controlling which policies get preallocation was inverted. Policies with prefixlen < threshold are exactly the ones routed through xfrm_policy_inexact_insert(), which allocates a new bin and node. The buggy loop preallocated for exact policies (which never allocate) and skipped inexact ones. The reinsert path therefore performs a GFP_ATOMIC allocation that can fail. On failure the error path only calls WARN_ONCE() and continues execution, leaving a bydst node whose list pointers are poisoned. The next invocation of xfrm_hash_rebuild() calls hlist_del_rcu() on that node, dereferences LIST_POISON2, and crashes.

Root Cause

The root cause is a logic error [CWE-670] in a preallocation guard combined with a non-recoverable error path. The condition selects the wrong subset of policies for preallocation, and the failure branch does not roll back or remove the corrupted entry, so a poisoned node persists across rebuilds.

Attack Vector

Exploitation is a local denial-of-service scenario. An unprivileged workload that induces memory pressure, or a fault-injection tool such as failslab, can deterministically force the GFP_ATOMIC allocation to fail during a policy rebuild. The next rebuild dereferences LIST_POISON2 (observed as address 0xdead000000000122 in the reported oops) and produces a fatal exception in the events workqueue, panicking the kernel.

The vulnerability is not a memory-corruption primitive suitable for privilege escalation based on the available advisory data. See the upstream commits for technical details: kernel commit 6aa3796d18a9, kernel commit 7acc5ed2f336, and kernel commit f38f8cce2f7e.

// No verified exploit code is available. The crash signature reported upstream:
// Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024
// KASAN: maybe wild-memory-access in range [0xdead...]
// Workqueue: events xfrm_hash_rebuild
// RIP: 0010:xfrm_hash_rebuild+0x5b3/0x1190
// RAX: dead000000000122   (LIST_POISON2 + offset)
// Call Trace: hlist_del_rcu -> xfrm_hash_rebuild -> process_one_work

Detection Methods for CVE-2026-64579

Indicators of Compromise

Kernel oops entries referencing xfrm_hash_rebuild+0x5b3/0x1190 in the crash RIP.
Register state showing RAX: dead000000000122, the LIST_POISON2 sentinel plus offset.
WARN_ONCE() messages from xfrm_policy_inexact_insert() failing under memory pressure prior to the crash.
Kernel panic messages tagged Workqueue: events xfrm_hash_rebuild.

Detection Strategies

Parse /var/log/kern.log and dmesg for the specific call trace hlist_del_rcu → xfrm_hash_rebuild → process_one_work.
Correlate IPsec policy configuration changes (ip xfrm policy updates) with subsequent workqueue warnings on the same host.
Enable KASAN on canary hosts to catch the wild-memory access before it becomes a panic on production nodes.

Monitoring Recommendations

Track kernel version inventory against the fixed commit hashes to identify unpatched hosts running IPsec.
Alert on repeated xfrm_policyWARN_ONCE messages, which indicate the failed allocation state that precedes the crash.
Monitor host availability metrics for IPsec gateways and VPN concentrators, where unplanned reboots may signal exploitation attempts.

How to Mitigate CVE-2026-64579

Immediate Actions Required

Apply the upstream fix that inverts the preallocation guard so preallocation covers exactly the reinserted policies.
Update to a stable kernel that includes commits 6aa3796d18a9, 7acc5ed2f336, 94c00391a511, d9d9cc21cc90, or f38f8cce2f7e.
Prioritize patching IPsec gateways, VPN concentrators, and any host that dynamically reconfigures xfrm policies.

Patch Information

The fix inverts the guard in xfrm_hash_rebuild() so that the first loop preallocates bins and chains for inexact policies (prefixlen < threshold). After the fix, the reinsert loop performs no allocations and cannot fail, eliminating the poisoned-node condition. Patches are tracked at kernel commit 94c00391a511 and kernel commit d9d9cc21cc90.

Workarounds

Avoid dynamic policy reconfiguration on hosts under memory pressure until the kernel is patched.
Reduce memory pressure on IPsec hosts by tuning workloads or increasing available memory to lower the probability of GFP_ATOMIC failure.
Restrict administrative access to IPsec policy management so untrusted local users cannot trigger repeated policy rebuilds.

bash

# Verify the running kernel contains one of the fix commits
uname -r
zgrep -E '6aa3796d18a9|7acc5ed2f336|94c00391a511|d9d9cc21cc90|f38f8cce2f7e' /proc/config.gz 2>/dev/null || \
  grep -E '6aa3796d18a9|7acc5ed2f336|94c00391a511|d9d9cc21cc90|f38f8cce2f7e' /boot/config-$(uname -r)

# Watch for the pre-crash warning on IPsec hosts
dmesg -wH | grep -Ei 'xfrm|hash_rebuild|LIST_POISON'