Skip to main content

Linux Kernel CVE-2026-64163

| EUVDEUVD-2026-45848 MEDIUM
2026-07-19 Linux GHSA-9292-g249-69fp
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local vector confirmed by debugfs write requirement; PR:L because any user with debugfs write access can trigger it; A:H for kernel panic; no C or I impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.4 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 13, 2026 - 16:11 vuln.today
CVSS changed
Aug 13, 2026 - 15:37 NVD
5.5 (MEDIUM)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:40 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:40 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

test_kprobes: clear kprobes between test runs

Running the kprobes sanity tests twice makes all tests fail and eventually crashes the kernel.

[root@martin-riscv-1 ~]

echo 1 > /sys/kernel/debug/kunit/kprobes_test/run

...

Totals: pass:5 fail:0 skip:0 total:5

ok 1 kprobes_test [root@martin-riscv-1 ~]

echo 1 > /sys/kernel/debug/kunit/kprobes_test/run

...

test_kprobe: EXPECTATION FAILED at lib/tests/test_kprobes.c:64

Expected 0 register_kprobe(&kp), but register_kprobe(&kp) -22 (0xffffffffffffffea) ... Unable to handle kernel paging request ...

The testsuite defines several kprobes and kretprobes as static variables that are preserved across test runs.

After register_kprobe and unregister_kprobe, a kprobe contains some leftover data that must be cleared before the kprobe can be registered again. The tests are setting symbol_name to define the probe location. Address and flags must be cleared.

The existing code clears some of the probes between subsequent tests, but not between two test runs. The leftover data from a previous test run makes the registrations fail in the next run.

Move the cleanups for all kprobes into kprobes_test_init, this function is called before each single test (including the first test of a test run).

AnalysisAI

Kernel panic in the Linux kernel's kprobes self-test module (test_kprobes) allows a local attacker or privileged user with debugfs write access to crash the kernel by triggering the KUnit kprobes test suite twice in succession. The root cause is that static kprobe and kretprobe variables retain stale address and flag data after unregister_kprobe, causing re-registration to fail with -EINVAL and subsequently triggering a kernel paging fault on the second test run. No public exploit is identified at time of analysis; EPSS at the 6th percentile and absence from CISA KEV confirm this as low-priority in production contexts.

Technical ContextAI

The vulnerability resides in lib/tests/test_kprobes.c, a KUnit-based self-test module for the Linux kernel's kprobes dynamic instrumentation subsystem. Kprobes allows inserting breakpoints into running kernel code for debugging; kretprobes additionally intercept function return values. The module declares several kprobe and kretprobe structs as static variables. After a call sequence of register_kprobe followed by unregister_kprobe, internal kernel fields - specifically the resolved address and state flags - are not zeroed, leaving the struct in a state incompatible with re-registration. The test initializer (kprobes_test_init) was not performing full cleanup of all probe structs, only partial cleanup between sub-tests within a single run. On a second run, register_kprobe encounters non-null stale addresses and rejects registration with -EINVAL (-22), and subsequent access to uninitialized pointers triggers a kernel paging fault (NULL/stale pointer dereference). CPE data (cpe:2.3:a:linux:linux) confirms the affected product as the upstream Linux kernel, introduced at commit e44e81c5b90f698025eadceb7eef8661eda117d5, corresponding to Linux 5.16.

RemediationAI

Upgrade to a patched Linux kernel version: 6.6.142, 6.12.92, 6.18.34, 7.0.11, or 7.1, as documented in EUVD-2026-45848 and the upstream stable commits at https://git.kernel.org/stable/c/08d355936fcf70c81c94f9fe7310450b65c53399 and associated commits. Ubuntu users should apply the update referenced in USN-8593-1 at https://ubuntu.com/security/notices/USN-8593-1. As a compensating control where patching is not immediately possible, disable or restrict write access to /sys/kernel/debug/kunit/kprobes_test/run via filesystem permissions or by not mounting debugfs on affected hosts; trade-off is loss of KUnit test execution capability. Alternatively, ensure that CONFIG_KUNIT and the kprobes test module are not compiled into production kernels, which is already best practice for hardened deployments - this eliminates the attack surface entirely with no functional trade-off in non-testing environments.

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-64163 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy