Skip to main content

Linux Kernel CVE-2026-64189

| EUVDEUVD-2026-46009 HIGH
Race Condition (CWE-362)
2026-07-20 Linux GHSA-38c9-7h78-x2jx
Linux Race Condition Canonical
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Obtain local access with user namespace or CAP_NET_ADMIN
  2. Delivery
    Open Netlink ipset dump via recvmsg
  3. Exploit
    Concurrently trigger ip_set_create() array resize
  4. Install
    Race dump read of old array past synchronize_net() completion
  5. C2
    Old ip_set_list array freed while dump indexes it
  6. Execute
    Slab use-after-free
  7. Impact
    Kernel memory corruption or panic

Vulnerability Assessment

Weakness
CWE
CWE-362
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires a local attacker with access to Netlink sockets for the netfilter subsystem - typically CAP_NET_ADMIN, which can be obtained by an unprivileged user in a user namespace on distributions that permit unprivileged user namespaces (including default configurations of Ubuntu, Fedora, and many Debian derivatives). The race requires simultaneous execution of two operations: a Netlink ipset dump (via recvmsg on a Netlink socket) and an ip_set_create() call that grows the ip_set_list array. Limiting factors: attack is local only (AV:L); a timing race must be won (narrow window, practical AC:H despite AC:L in the provided vector); CAP_NET_ADMIN or equivalent user namespace privilege is required; ipset functionality must be in use or accessible. The vulnerability does NOT require root directly, but user namespace restrictions (kernel.unprivileged_userns_clone=0) would block unprivileged exploitation paths.
Impact

The provided CVSS 7.8 (AV:L/AC:L/PR:L) overstates the attack complexity: this is a race condition requiring simultaneous execution of a Netlink dump and an ip_set_create() resize within a narrow timing window, which in practice warrants AC:H, reducing the realistic score to approximately 7.0. EPSS of 0.16% (5th percentile) is consistent with no confirmed public weaponization. There is no CISA KEV listing. The KASAN trace in the description uses the task name 'exploit/150', strongly suggesting a working PoC was developed by the reporter to confirm exploitability, but this has not been publicly released and should not be equated with confirmed active exploitation. The local attack vector (AV:L) combined with the race window substantially reduces the exploitability compared to what the C:H/I:H/A:H impact metrics might imply. Ubuntu has already issued downstream advisories (USN-8727-1, USN-8726-1), indicating rapid vendor response. Overall priority: medium-high for servers where unprivileged users can access user namespaces and Netlink sockets; lower for hardened deployments with user namespace restrictions.
Exploit ScenarioDerived

A local user with CAP_NET_ADMIN or access via a user namespace opens a Netlink dump of the ipset list while a second thread concurrently calls ip_set_create() to add a new set, triggering an ip_set_list array resize. If the dump path reads the old array pointer at the exact moment synchronize_net() completes and the old array is kvfree()d, the dump code subsequently dereferences a freed slab address. The KASAN trace in the CVE description shows a read of size 8 at a freed address in ip_set_dump_do at line 1697, followed by a kernel panic, confirming the bug is reliably reproducible with the right timing.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 16, 2026

Use-after-free in the Linux kernel netfilter ipset subsystem allows a local user with Netlink privilege to corrupt kernel memory by racing dump operations against a concurrent ip_set_list array resize. The dump callbacks ip_set_dump_do() and ip_set_dump_done() dereference the inst->ip_set_list array pointer outside any RCU read-side critical section; a concurrent ip_set_create() publishes a new array, calls synchronize_net(), and then frees the old array - but synchronize_net() does not wait for the unprotected dump readers, resulting in a slab use-after-free. No public exploit has been confirmed at time of analysis, though the KASAN trace embedded in the CVE description references a task named 'exploit/150', indicating a functional proof-of-concept was used to produce the report during responsible disclosure.

RemediationAI

Apply the vendor-released kernel patches available at the kernel.org stable commits: ff86ea9b7fdf70564e60436fbee68c96bc459943, 81d54c766337b923eec26da0a13406760b091093, e8ee198bbc04a32d336e79160fde980e0235b39f, 7cd9103283b26b917360ec99d7d2f2d761bcf1ab, and additional commits referenced via NVD (1bc67c3f, 96fbafc2, a7a29927, e8a9976b). Fixed upstream versions are 7.2-rc2, 7.1.4, 6.18.39, and 6.12.96. Ubuntu users should apply updates per USN-8727-1 and USN-8726-1 (https://ubuntu.com/security/notices/USN-8727-1, https://ubuntu.com/security/notices/USN-8726-1). As a temporary compensating control on distributions that support it, restricting unprivileged user namespaces via 'sysctl kernel.unprivileged_userns_clone=0' (Debian/Ubuntu) or equivalent reduces the attack surface by preventing low-privilege users from obtaining CAP_NET_ADMIN within a user namespace; note this breaks container workloads that depend on rootless namespaces. Kernel live-patching solutions (kpatch, kGraft, livepatch) may be applicable for production systems requiring zero-downtime remediation.

Affected VersionsENISA

Linux patch: 0
Linux patch: 7.2-rc2
Linux 4.19.5 <4.20
Linux 8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7 <7cd9103283b26b917360ec99d7d2f2d761bcf1ab
Linux patch: 7.1.4
Linux 2f6bf7917f55f9dae913193e49672b3598620eab
Linux 8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7 <81d54c766337b923eec26da0a13406760b091093
Linux 8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7 <e8ee198bbc04a32d336e79160fde980e0235b39f
Linux 4.20
Linux 8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7 <ff86ea9b7fdf70564e60436fbee68c96bc459943
Linux patch: 6.18.39
Linux patch: 6.12.96

Affected Packages

euvd linux fix: 4.20

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability is in net/netfilter/ipset/ip_set_core.c within the Linux kernel's netfilter ipset framework, which provides efficient packet matching against large sets of IP addresses and networks via Netlink. The dump path (ip_set_dump_do, ip_set_dump_done) is invoked from netlink_recvmsg() without the nfnl mutex and without an RCU read-side critical section; it accesses inst->ip_set_list through ip_set_ref_netlink(), which uses rcu_dereference_raw(). Concurrently, ip_set_create() legitimately grows the array using RCU replace-then-free: it publishes the new pointer, calls synchronize_net() to wait for current RCU readers, then kvfree()s the old array. Because the dump paths are not inside rcu_read_lock(), synchronize_net() considers them as not in a read-side critical section and does not wait for them, making the old array eligible for immediate freeing while still being indexed by the dump code. The root cause is CWE-362 (concurrent execution with insufficient synchronization), with CWE-416 (use-after-free) as the memory-safety consequence. The fix wraps the array dereference in rcu_read_lock()/rcu_read_unlock(), matching the locking discipline already used in ip_set_get_byname() and __ip_set_put_byindex(). Affected CPE: cpe:2.3:a:linux:linux.

Know when Canonical gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Race condition requires precise concurrent timing (AC:H); PR:L reflects CAP_NET_ADMIN or user namespace access; local attack vector only; no scope change.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 27, 2026 - 05:22 NVD
7.8 (HIGH)
Patch available
Jul 20, 2026 - 18:18 EUVD
CVE Published
Jul 20, 2026 - 16:27 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 20, 2026 - 16:27 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: fix race between dump and ip_set_list resize

The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw() of the array pointer. These run from netlink_recvmsg() without the nfnl mutex and without an RCU read-side critical section.

A concurrent ip_set_create() can grow the array: it publishes the new array, calls synchronize_net() and then kvfree()s the old one. Since the dump paths read the array outside any RCU reader, synchronize_net() does not wait for them and the old array can be freed while they still index into it, causing a use-after-free.

The dumped set itself stays pinned via set->ref_netlink, so only the array load needs protecting. Take rcu_read_lock() around it, matching ip_set_get_byname() and __ip_set_put_byindex().

BUG: KASAN: slab-use-after-free in ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697) Read of size 8 at addr ffff88800b5c4018 by task exploit/150 Call Trace: ... kasan_report (mm/kasan/report.c:595) ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697) netlink_dump (net/netlink/af_netlink.c:2325) netlink_recvmsg (net/netlink/af_netlink.c:1976) sock_recvmsg (net/socket.c:1159) __sys_recvfrom (net/socket.c:2315) ... Oops: general protection fault, probably for non-canonical address ... KASAN NOPTI KASAN: maybe wild-memory-access in range [0x02d6...d0-0x02d6...d7] RIP: 0010:ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1698) Kernel panic - not syncing: Fatal exception

Executive ViewAI

Why It Matters

The Linux kernel netfilter ipset module contains a critical memory corruption flaw (CVE-2026-64189, CVSS 7.8) that could allow local users to escalate privileges on affected systems. This impacts any organization relying on Linux-based firewalling or packet inspection infrastructure. Patched kernel versions are available and should be prioritized for deployment on systems in untrusted environments.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
Ubiquitous
Linux kernel underlies virtually all Linux-based production systems
Social Media
1
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).

More in Canonical

View all
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2016-3714 HIGH POC
8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2016-5195 HIGH POC
7.0 Nov 10

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
CVE-2013-2423 LOW POC
3.7 Apr 17

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected

Same weakness CWE-362 – Race Condition

View all
CVE-2023-36884 HIGH POC
7.5
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2025-39964 MEDIUM POC
5.5

Same technique Race Condition

View all
CVE-2026-27175 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-64189 ADVISORY https://seclists.org/oss-sec/2026/q3/230 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/380670 REF https://git.kernel.org/stable/c/1bc67c3fc98e9fc07032cc56afcdbc690c47d11e REF https://git.kernel.org/stable/c/7cd9103283b26b917360ec99d7d2f2d761bcf1ab REF https://git.kernel.org/stable/c/81d54c766337b923eec26da0a13406760b091093 REF https://git.kernel.org/stable/c/96fbafc20ebd9a613736c2998b89c539fe3042f5 REF https://git.kernel.org/stable/c/a7a299277959683204d73333c32c092fd69327d4 REF https://git.kernel.org/stable/c/e8a9976b61f1bc4aa7fd25fa26726dfdf2adf710 REF https://git.kernel.org/stable/c/e8ee198bbc04a32d336e79160fde980e0235b39f REF https://git.kernel.org/stable/c/ff86ea9b7fdf70564e60436fbee68c96bc459943

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy