---
id: CVE-2026-64563
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  rhashtable: clear stale iter->p on table restart

  rhashtable_walk_start_check() has two restart paths when resuming a walk.
  When iter->walker.tbl is valid, it re-valida…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  rhashtable: clear stale iter->p on table restart

  rhashtable_walk_start_check() has two restart paths when resuming a walk.
  When iter->walker.tbl is valid, it re-valida…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
published: '2026-08-04'
updated: '2026-08-08'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64563'
references:
  - url: 'https://git.kernel.org/stable/c/3ff7c1dbf722cf3fa538672452ba182318e0fcc3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4169d9fb92f313ff8e7e83d733c1ecdcc93eebd3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8173f7e2ce67e6ca1d4763f3da14e5b01ce77456'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64563.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-64563'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2510892'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-64563'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64563'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026080404-CVE-2026-64563-9d7f@gregkh/T
  - url: 'https://access.redhat.com/errata/RHSA-2026:64770'
  - url: 'https://access.redhat.com/errata/RHSA-2026:64775'
  - url: 'https://access.redhat.com/errata/RHSA-2026:66180'
  - url: 'https://access.redhat.com/errata/RHSA-2026:66000'
tags:
  - nvd
  - exploit-available
  - csaf
  - vex
  - red-hat
epss: 0.00117
epssPercentile: 0.01915
ingestedAt: '2026-08-08T19:28:35.028Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/guard-wait/CVE-2026-64563_EXP'
  checkedAt: '2026-09-23T07:14:34.565Z'
exploitAvailable: true
vendor: Red Hat
product: Red Hat Enterprise Linux 9
affected:
  - enterprise_linux 10
  - enterprise_linux 8
  - enterprise_linux 9
  - enterprise_linux_nfv_v_8
  - enterprise_linux_rt_v_8
patched:
  - enterprise_linux_nfv_v_8
  - enterprise_linux_rt_v_8
cwe:
  - CWE-825
scores:
  nvd: 7.8
  vendor: 7.3
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

rhashtable: clear stale iter->p on table restart

rhashtable_walk_start_check() has two restart paths when resuming a walk.
When iter->walker.tbl is valid, it re-validates iter->p against the table
and sets iter->p = NULL if the object is gone.  When iter->walker.tbl is
NULL (table was freed during resize), it resets slot and skip but forgets
to clear iter->p.

rhashtable_walk_next() then dereferences the stale iter->p, reading
freed memory.  This is a use-after-free.

Any caller that does multi-fragment rhashtable walks across
walk_stop/walk_start boundaries is affected.  Concrete cases include
netlink_diag (__netlink_diag_dump in net/netlink/diag.c) and TIPC
(tipc_nl_sk_walk in net/tipc/socket.c).

Crash stack (netlink_diag):
  BUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365/0x3c0
  Read of size 8 at addr ffff88801a9d2438 (freed kmalloc-2k, offset 1080)
  Call Trace:
   rhashtable_walk_next+0x365/0x3c0 (lib/rhashtable.c:1016)
   __netlink_diag_dump+0x160/0x760 (net/netlink/diag.c:122)
   netlink_diag_dump+0xc2/0x240
   netlink_dump+0x5bc/0x1270
   netlink_recvmsg+0x7a3/0x980
   sock_recvmsg+0x1bc/0x200
   __sys_recvfrom+0x1d4/0x2c0

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:64770** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64770)
- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-09-10 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64563.json)
- **RHSA-2026:64775** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64775)
- **RHSA-2026:66180** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66180)
- **RHSA-2026:66000** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66000)