CVE Intelligence
Analysis AI-assisted

CVE-2026-64025: Linux kernel bpf skmsg verdict data_ready race with kTLS RX leading to use-after-free

CVE-2026-64025 is a race condition in the Linux kernel BPF sockmap verdict path: when a socket is in a sockmap before TLS RX is configured, the verdict data-ready callback can drain the receive queue that kTLS relies on. The record describes a resulting use-after-free in TLS decryption, and the CNA rates it 9.8 (CVSS 3.1, critical). Stable kernel fixes are listed for several branches.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-64025 affects the Linux kernel BPF skmsg code that handles socket verdict data-ready notifications. According to the record, a socket added to a sockmap with the BPF_SK_SKB_VERDICT program type before kTLS receive is configured can have its receive queue drained by the verdict callback. This conflicts with TLS ownership of that queue. The fix makes the verdict path mirror an existing guard already used by the strparser path.

Impact

  • The record describes a race condition (CWE-362) that can leave TLS decryption walking a buffer that has already been released, which is a use-after-free.
  • The CNA assigns a CVSS 3.1 base score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which is a critical rating. The record also lists the SSVC technical impact as total.
  • The record does not describe the concrete consequences beyond memory corruption and the use-after-free, such as crash behavior or data exposure. These are unknown from the sources consulted.

Affected products and versions

  • The Linux kernel stable branches listed in the record are affected from 5.10 up to before 6.6.142, from 6.7 up to before 6.12.92, from 6.13 up to before 6.18.34, and from 6.19 up to before 7.0.11.
  • The record also lists 7.1-rc1, 7.1-rc2, 7.1-rc3 and 7.1-rc4 as affected.
  • The first product entry in the record uses a mix of commit identifiers and a single version label, so its exact scope is not fully clear from the record alone. Consult the stable kernel commit pages and your distribution's security notices to confirm which builds include the fix.

Exploitation status

  • The record lists the CISA KEV catalog status as not listed, so the sources consulted do not confirm active exploitation in the wild.
  • The FIRST EPSS probability is 0.00343 with a percentile of 0.2664, and the SSVC exploitation field is none. These values indicate low modeled exploitation likelihood at the time of the record.

Remediation and mitigation

  • Update to a stable kernel release that contains the fix for your branch, using the patched stable kernel commits referenced in the record.
  • Where a patched kernel cannot be deployed immediately, follow vendor and distribution guidance. The record does not describe a workaround, so any mitigation is unknown from the sources consulted.
  • Prioritize systems that use kTLS receive together with BPF sockmap verdict programs, as these are the configurations the record describes.

Detection guidance

  • Inventory hosts running affected kernel branches and identify whether kTLS and BPF sockmap features are in use.
  • Monitor kernel logs for WARN messages and unexpected kernel oops related to the TLS or skmsg code paths, as the record notes a warning condition in the vulnerable flow.
  • The record does not provide specific indicators of compromise, so detection beyond general kernel health monitoring is unknown.

Limitations of the available information

  • The record does not describe the required privileges beyond the CVSS vector, nor the exact deployment conditions for a successful trigger beyond what is summarized.
  • Distribution backports and vendor-specific fixed versions are not listed in the record.
  • The introducing commit is identified only by a hash in the record and its full history is not described here.
  • Sources consulted: NVD entry, CVE Record and the referenced stable kernel commits.

Frequently asked questions

What is CVE-2026-64025?

It is a race condition in the Linux kernel BPF skmsg verdict path that can interfere with kTLS receive processing and, according to the record, lead to a use-after-free.

Is this vulnerability known to be exploited?

The record lists it as not in the CISA KEV catalog, and the sources consulted do not confirm exploitation in the wild.

How should administrators respond?

Update to a patched stable kernel for your branch, and check your distribution's advisories for backports, since the record does not describe a workaround.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.