CVE-2026-64015

HighCVSS 7.8/10Last modified Oct 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

security/keys: fix missed RCU read section on lookup

Nicholas Carlini reports that the keyring code calls assoc_array_find() in find_key_to_update() without holding the RCU read lock, while the assoc_array_gc() code really is designed around removing the node from the tree and then freeing it after an RCU grace-period.

The regular key handling doesn't see this because holding the keyring semaphore hides any lifetime issues, but the persistent key handling uses a different model.

Instead of extending the keyring locking, just do the simple RCU locking that the assoc_array was designed for.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125CWE-362

Affected software

VendorProductVersions
LinuxLinux>= b2a4df200d570b2c33a57e1ebfa5896e4bc81b69, < 1d8d987a2aacde238ecd0f4946f28cef74c42b79; >= b2a4df200d570b2c33a57e1ebfa5896e4bc81b69, < 5036a9aa7f21fbce89a2a8451bbc177bae2e920d; >= b2a4df200d570b2c33a57e1ebfa5896e4bc81b69, < 4c5d407ba3ff7f30561ff73ba1b07ed70c864edc; >= b2a4df200d570b2c33a57e1ebfa5896e4bc81b69, < cefa4265b11176c897a7d9e8e54d89e3701c5584; >= b2a4df200d570b2c33a57e1ebfa5896e4bc81b69, < 5659e6923cb72f8e18e8b539109ab512455fe195; >= b2a4df200d570b2c33a57e1ebfa5896e4bc81b69, < 50bb3435a5e627bfbdc52eb4536f49f88b3486b8; >= b2a4df200d570b2c33a57e1ebfa5896e4bc81b69, < 66288dcadf80974436250e9f70ed848836b835b5; >= b2a4df200d570b2c33a57e1ebfa5896e4bc81b69, < 43a1e3744548e6fd85873e6fb43e293eb4010694
LinuxLinux3.13

References

Timeline

Published
Jul 19, 2026
Last modified
Oct 30, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-640169.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifetime After a durable CVE-2026-640177.8In the Linux kernel, the following vulnerability has been resolved: blk-mq: pop cached request if it is usable When submitting a bio to blCVE-2026-640189.3In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rx_req_idx to prevent out-of-bounds array access ICVE-2026-640195.5In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma mapping leak on data setup error We're leaking the iCVE-2026-64026.5webpack-dev-server versions up to and including 5.2.3 are vulnerable to cross-origin source code exposure when serving over a non-potentiallCVE-2026-640207.5In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma_vecs leak on p2p memory We don't unmap P2P memory, sCVE-2026-640215.5In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix exec_queue leak on width check in stream open In xe_oa_CVE-2026-640225.5In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: remove the software node when deactivating the aggregCVE-2026-640237.8In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: fix a potential use-after-free On error we free aggrCVE-2026-640249.4In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction Blamed CVE-2026-640259.8In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx sk_psock_strCVE-2026-640267.8In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvms
CVE-2026-64015: High severity, CVSS 7.8 | Vulnix