{"id":"CVE-2026-64563","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nrhashtable: clear stale iter->p on table restart\n\nrhashtable_walk_start_check() has two restart paths when resuming a walk.\nWhen iter->walker.tbl is valid, it re-valida…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nrhashtable: clear stale iter->p on table restart\n\nrhashtable_walk_start_check() has two restart paths when resuming a walk.\nWhen iter->walker.tbl is valid, it re-valida…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","published":"2026-08-04","updated":"2026-08-08","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64563","references":[{"url":"https://git.kernel.org/stable/c/3ff7c1dbf722cf3fa538672452ba182318e0fcc3","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4169d9fb92f313ff8e7e83d733c1ecdcc93eebd3","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8173f7e2ce67e6ca1d4763f3da14e5b01ce77456","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64563.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-64563"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2510892"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64563"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64563"},{"url":"https://lore.kernel.org/linux-cve-announce/2026080404-CVE-2026-64563-9d7f@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:64770"},{"url":"https://access.redhat.com/errata/RHSA-2026:64775"},{"url":"https://access.redhat.com/errata/RHSA-2026:66180"},{"url":"https://access.redhat.com/errata/RHSA-2026:66000"}],"tags":["nvd","exploit-available","csaf","vex","red-hat"],"epss":0.00117,"epssPercentile":0.01913,"ingestedAt":"2026-08-08T19:28:35.028Z","exploits":{"github":1,"githubRepos":["https://github.com/guard-wait/CVE-2026-64563_EXP"],"checkedAt":"2026-09-21T15:30:07.338Z"},"exploitAvailable":true,"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 10","enterprise_linux 8","enterprise_linux 9","enterprise_linux_nfv_v_8","enterprise_linux_rt_v_8"],"patched":["enterprise_linux_nfv_v_8","enterprise_linux_rt_v_8"],"cwe":["CWE-825"],"scores":{"nvd":7.8,"vendor":7.3},"slug":"CVE-2026-64563","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nrhashtable: clear stale iter->p on table restart\n\nrhashtable_walk_start_check() has two restart paths when resuming a walk.\nWhen iter->walker.tbl is valid, it re-validates iter->p against the table\nand sets iter->p = NULL if the object is gone.  When iter->walker.tbl is\nNULL (table was freed during resize), it resets slot and skip but forgets\nto clear iter->p.\n\nrhashtable_walk_next() then dereferences the stale iter->p, reading\nfreed memory.  This is a use-after-free.\n\nAny caller that does multi-fragment rhashtable walks across\nwalk_stop/walk_start boundaries is affected.  Concrete cases include\nnetlink_diag (__netlink_diag_dump in net/netlink/diag.c) and TIPC\n(tipc_nl_sk_walk in net/tipc/socket.c).\n\nCrash stack (netlink_diag):\n  BUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365/0x3c0\n  Read of size 8 at addr ffff88801a9d2438 (freed kmalloc-2k, offset 1080)\n  Call Trace:\n   rhashtable_walk_next+0x365/0x3c0 (lib/rhashtable.c:1016)\n   __netlink_diag_dump+0x160/0x760 (net/netlink/diag.c:122)\n   netlink_diag_dump+0xc2/0x240\n   netlink_dump+0x5bc/0x1270\n   netlink_recvmsg+0x7a3/0x980\n   sock_recvmsg+0x1bc/0x200\n   __sys_recvfrom+0x1d4/0x2c0\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:64770** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64770)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-09-10 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64563.json)\n- **RHSA-2026:64775** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64775)\n- **RHSA-2026:66180** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66180)\n- **RHSA-2026:66000** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66000)","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":5398,"id":"CVE-2026-64563","ts":1788887280057,"field":"exploit_available","old":"false","new":"true"},{"seq":4281,"id":"CVE-2026-64563","ts":1788886394062,"field":"exploit_available","old":"true","new":"false"},{"seq":3030,"id":"CVE-2026-64563","ts":1788883057711,"field":"exploit_available","old":"false","new":"true"},{"seq":2059,"id":"CVE-2026-64563","ts":1788882462171,"field":"exploit_available","old":"true","new":"false"},{"seq":1132,"id":"CVE-2026-64563","ts":1788881899164,"field":"exploit_available","old":"false","new":"true"}]}