Linux EUVD-2026-46009

We need to process CVE-2026-64189. The user wants a JSON with multiple fields, all plain text strings. We'll synthesize all provided data: description, EPSS, KEV? Not in input, KEV not mentioned, so assume no KEV. EPSS 0.16% low. Patch available from vendor? The patch data says "Patch: Available from vendor" but also shows Linux version ranges and patch commits. Tags: Canonical, Information Disclosure, Linux. CWE: N/A. CVSS: 7.8, vector local.

We need to be careful: all fields must be strings, not arrays. The product_name: "Linux" (too generic? The affected product is the ipset subsystem in the Linux kernel's netfilter. So "Linux kernel" or "ipset"? The CPE is "cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*" – that's the Linux kernel. I'll choose "Linux kernel". But the instruction says "1-3 words ONLY. The specific product or service name affected." Could be "Linux kernel", "netfilter ipset", maybe "Linux ipset". However, CPE says "linux:linux" which is the kernel. I'll go with "Linux kernel".

Summary: need to synthesize description and mention EPSS, active exploitation status (none), POC? No mention of POC. So "no public exploit identified at time of analysis." But description has use-after-free in ipset dump race. So summary: "Local privilege escalation in the Linux kernel's netfilter ipset subsystem allows a local attacker to trigger a use-after-free during dump operations, potentially leading to memory corruption and privilege escalation." Need to mention EPSS low, no active exploitation. The CVSS is 7.8 (local, low privileges). So summary: "Local privilege escalation in the Linux kernel's netfilter ipset subsystem allows a local attacker to trigger a use-after-free during concurrent dump and resize operations, potentially achieving elevated privileges. No public exploit or active exploitation has been identified; EPSS score low (0.16%)."

Technical_context: Explain the underlying technology: netfilter, ipset, netlink socket communication. Use-after-free due to missin