GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-64581 (GCVE-0-2026-64581)

Vulnerability from cvelistv5 – Published: 2026-08-05 08:09 – Updated: 2026-08-27 12:39
VLAI
Title
xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
Summary
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() xfrm_user_policy() clears the socket dst cache with __sk_dst_reset(), i.e. the non-atomic __sk_dst_set(sk, NULL): it reads sk_dst_cache with rcu_dereference_protected(), stores NULL and dst_release()s the old dst. That is only safe if no other thread modifies sk_dst_cache concurrently. For a connected UDP socket that does not hold: the transmit fast path (udp_sendmsg -> sk_dst_check -> sk_dst_reset) resets the cache locklessly with an atomic xchg(). A per-socket policy change racing a send can make both sides observe the same old dst and each dst_release() it, dropping the socket's single reference twice and freeing the xfrm_dst bundle while it is still referenced: BUG: KASAN: slab-use-after-free in dst_release Write of size 4 at addr ffff88801897b6c0 by task exploit/155 Call Trace: ... dst_release (... ./include/linux/rcuref.h:109) xfrm_user_policy (./include/net/sock.h:2239 ./include/net/sock.h:2256 net/xfrm/xfrm_state.c:3053) do_ip_setsockopt (net/ipv4/ip_sockglue.c:1347) ip_setsockopt (net/ipv4/ip_sockglue.c:1417) do_sock_setsockopt (net/socket.c:2368) __sys_setsockopt (net/socket.c:2393) __x64_sys_setsockopt (net/socket.c:2396) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Reachable by an unprivileged user via a user+network namespace. Use the atomic sk_dst_reset() so the cache is cleared and released with a single xchg(): whichever side wins releases the dst once, the other sees NULL and does nothing. Behaviour is otherwise unchanged.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 , < e8686fd8d18b99f3a9038683045b2f2338a7706d (git)
Affected: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 , < a9340ebdc13f8bb5063c0bc0b037ee7e640d4ae9 (git)
Affected: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 , < f833821e4b52ab6335d443ede5fb79c38e61d19a (git)
Affected: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 , < f0ab9a71167bae308e05ab13b65e2007504a603f (git)
Affected: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 , < 8dd8929b71c4f06c614f8f54c2cc070453faae16 (git)
Affected: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 , < 0ea8f06454012d9e7f9c6e6253df710949bf6294 (git)
Affected: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 , < 96b678d08268b5f5c6fc99d4289d9b7e334fc683 (git)
Affected: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 , < c283e9ada7fcb7dd4b10592623086b2e6d2f9925 (git)
Affected: 72f157be2f81910ae759bfe2e5c2256fc4625645 (git)
Affected: 9e9fe58a92a46c6d154d2901735bf230d91b8507 (git)
Affected: adc1ec6cdc20d430aa01b86497220709b9149466 (git)
Affected: b54033eb1cfd77aba471269ddd804ed8d3e35dea (git)
Affected: c9e82cb34c3c2ee895af01bc899c6ed0bc6eb04a (git)
Affected: 5eef9b51114fcc65651d671add52f267f91b9451 (git)
Affected: 3.16.52 , < 3.17 (semver)
Affected: 4.4.163 , < 4.5 (semver)
Affected: 3.18.101 , < 3.19 (semver)
Affected: 4.1.52 , < 4.2 (semver)
Affected: 4.4.123 , < 4.5 (semver)
Affected: 4.9.89 , < 4.10 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 4.14
Unaffected: 0 , < 4.14 (semver)
Unaffected: 5.10.267 , ≤ 5.10.* (semver)
Unaffected: 5.15.218 , ≤ 5.15.* (semver)
Unaffected: 6.1.185 , ≤ 6.1.* (semver)
Unaffected: 6.6.154 , ≤ 6.6.* (semver)
Unaffected: 6.12.106 , ≤ 6.12.* (semver)
Unaffected: 6.18.47 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e8686fd8d18b99f3a9038683045b2f2338a7706d",
              "status": "affected",
              "version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
              "versionType": "git"
            },
            {
              "lessThan": "a9340ebdc13f8bb5063c0bc0b037ee7e640d4ae9",
              "status": "affected",
              "version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
              "versionType": "git"
            },
            {
              "lessThan": "f833821e4b52ab6335d443ede5fb79c38e61d19a",
              "status": "affected",
              "version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
              "versionType": "git"
            },
            {
              "lessThan": "f0ab9a71167bae308e05ab13b65e2007504a603f",
              "status": "affected",
              "version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
              "versionType": "git"
            },
            {
              "lessThan": "8dd8929b71c4f06c614f8f54c2cc070453faae16",
              "status": "affected",
              "version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
              "versionType": "git"
            },
            {
              "lessThan": "0ea8f06454012d9e7f9c6e6253df710949bf6294",
              "status": "affected",
              "version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
              "versionType": "git"
            },
            {
              "lessThan": "96b678d08268b5f5c6fc99d4289d9b7e334fc683",
              "status": "affected",
              "version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
              "versionType": "git"
            },
            {
              "lessThan": "c283e9ada7fcb7dd4b10592623086b2e6d2f9925",
              "status": "affected",
              "version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "72f157be2f81910ae759bfe2e5c2256fc4625645",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9e9fe58a92a46c6d154d2901735bf230d91b8507",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "adc1ec6cdc20d430aa01b86497220709b9149466",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b54033eb1cfd77aba471269ddd804ed8d3e35dea",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c9e82cb34c3c2ee895af01bc899c6ed0bc6eb04a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5eef9b51114fcc65651d671add52f267f91b9451",
              "versionType": "git"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.52",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.163",
              "versionType": "semver"
            },
            {
              "lessThan": "3.19",
              "status": "affected",
              "version": "3.18.101",
              "versionType": "semver"
            },
            {
              "lessThan": "4.2",
              "status": "affected",
              "version": "4.1.52",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.123",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.89",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.267",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.106",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.47",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.267",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.218",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.185",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.154",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.106",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.47",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.52",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.163",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.18.101",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.1.52",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.123",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.89",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix sk_dst_cache double-free in xfrm_user_policy()\n\nxfrm_user_policy() clears the socket dst cache with __sk_dst_reset(),\ni.e. the non-atomic __sk_dst_set(sk, NULL): it reads sk_dst_cache with\nrcu_dereference_protected(), stores NULL and dst_release()s the old dst.\nThat is only safe if no other thread modifies sk_dst_cache concurrently.\n\nFor a connected UDP socket that does not hold: the transmit fast path\n(udp_sendmsg -\u003e sk_dst_check -\u003e sk_dst_reset) resets the cache locklessly\nwith an atomic xchg(). A per-socket policy change racing a send can make\nboth sides observe the same old dst and each dst_release() it, dropping\nthe socket\u0027s single reference twice and freeing the xfrm_dst bundle while\nit is still referenced:\n\n  BUG: KASAN: slab-use-after-free in dst_release\n  Write of size 4 at addr ffff88801897b6c0 by task exploit/155\n  Call Trace:\n   ...\n   dst_release (... ./include/linux/rcuref.h:109)\n   xfrm_user_policy (./include/net/sock.h:2239 ./include/net/sock.h:2256 net/xfrm/xfrm_state.c:3053)\n   do_ip_setsockopt (net/ipv4/ip_sockglue.c:1347)\n   ip_setsockopt (net/ipv4/ip_sockglue.c:1417)\n   do_sock_setsockopt (net/socket.c:2368)\n   __sys_setsockopt (net/socket.c:2393)\n   __x64_sys_setsockopt (net/socket.c:2396)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\nReachable by an unprivileged user via a user+network namespace.\n\nUse the atomic sk_dst_reset() so the cache is cleared and released with a\nsingle xchg(): whichever side wins releases the dst once, the other sees\nNULL and does nothing. Behaviour is otherwise unchanged."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggered via setsockopt(IP_XFRM_POLICY/IP_IPSEC_POLICY) on a local socket racing concurrent udp_sendmsg; entry is a local syscall path (do_ip_setsockopt -\u003e xfrm_user_policy), not packet processing.\nAC:L - Attacker controls both sides of the race (one thread setsockopt to clear/apply per-socket xfrm policy, another sendmsg on the same connected UDP socket) and can create the obsolete xfrm_dst precondition in their netns, retrying until the double dst_release wins.\nPR:L - Path requires CAP_NET_ADMIN checked with sockopt_ns_capable(sock_net(sk)-\u003euser_ns), which an unprivileged user obtains via user+network namespaces; the fix commit explicitly states this reachability.\nUI:N - Exploitation uses only the attacker\u0027s own socket, threads, and setsockopt/sendmsg loops; no victim action or cooperation is required.\nS:U - Double-free/UAF of the socket\u0027s dst_entry/xfrm_dst is standard local kernel memory corruption within the host kernel authority, not a VM escape or other cross-boundary impact.\nC:H - Double dst_release frees the xfrm_dst slab object while still referenced, yielding a use-after-free that can be reclaimed/sprayed to disclose kernel memory via corrupted dst contents and ops.\nI:H - The UAF targets a dst_entry with function pointers (ops/input/output) used on transmit, enabling heap reuse for arbitrary write and control-flow hijack consistent with comparable sk_dst_cache races.\nA:H - The KASAN slab-use-after-free in dst_release demonstrates kernel memory corruption that can oops/panic, and the attacker can repeat the race freely."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T12:39:44.254Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e8686fd8d18b99f3a9038683045b2f2338a7706d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9340ebdc13f8bb5063c0bc0b037ee7e640d4ae9"
        },
        {
          "url": "https://git.kernel.org/stable/c/f833821e4b52ab6335d443ede5fb79c38e61d19a"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0ab9a71167bae308e05ab13b65e2007504a603f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8dd8929b71c4f06c614f8f54c2cc070453faae16"
        },
        {
          "url": "https://git.kernel.org/stable/c/0ea8f06454012d9e7f9c6e6253df710949bf6294"
        },
        {
          "url": "https://git.kernel.org/stable/c/96b678d08268b5f5c6fc99d4289d9b7e334fc683"
        },
        {
          "url": "https://git.kernel.org/stable/c/c283e9ada7fcb7dd4b10592623086b2e6d2f9925"
        }
      ],
      "title": "xfrm: fix sk_dst_cache double-free in xfrm_user_policy()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64581",
    "datePublished": "2026-08-05T08:09:35.556Z",
    "dateReserved": "2026-07-19T15:36:31.798Z",
    "dateUpdated": "2026-08-27T12:39:44.254Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64581",
      "date": "2026-09-16",
      "epss": "0.00117",
      "percentile": "0.01909"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64581\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-05T08:16:38.177\",\"lastModified\":\"2026-08-27T13:18:30.887\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxfrm: fix sk_dst_cache double-free in xfrm_user_policy()\\n\\nxfrm_user_policy() clears the socket dst cache with __sk_dst_reset(),\\ni.e. the non-atomic __sk_dst_set(sk, NULL): it reads sk_dst_cache with\\nrcu_dereference_protected(), stores NULL and dst_release()s the old dst.\\nThat is only safe if no other thread modifies sk_dst_cache concurrently.\\n\\nFor a connected UDP socket that does not hold: the transmit fast path\\n(udp_sendmsg -\u003e sk_dst_check -\u003e sk_dst_reset) resets the cache locklessly\\nwith an atomic xchg(). A per-socket policy change racing a send can make\\nboth sides observe the same old dst and each dst_release() it, dropping\\nthe socket\u0027s single reference twice and freeing the xfrm_dst bundle while\\nit is still referenced:\\n\\n  BUG: KASAN: slab-use-after-free in dst_release\\n  Write of size 4 at addr ffff88801897b6c0 by task exploit/155\\n  Call Trace:\\n   ...\\n   dst_release (... ./include/linux/rcuref.h:109)\\n   xfrm_user_policy (./include/net/sock.h:2239 ./include/net/sock.h:2256 net/xfrm/xfrm_state.c:3053)\\n   do_ip_setsockopt (net/ipv4/ip_sockglue.c:1347)\\n   ip_setsockopt (net/ipv4/ip_sockglue.c:1417)\\n   do_sock_setsockopt (net/socket.c:2368)\\n   __sys_setsockopt (net/socket.c:2393)\\n   __x64_sys_setsockopt (net/socket.c:2396)\\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\\n\\nReachable by an unprivileged user via a user+network namespace.\\n\\nUse the atomic sk_dst_reset() so the cache is cleared and released with a\\nsingle xchg(): whichever side wins releases the dst once, the other sees\\nNULL and does nothing. Behaviour is otherwise unchanged.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/xfrm/xfrm_state.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2b06cdf3e688b98fcc9945873b5d42792bd4eee0\",\"lessThan\":\"e8686fd8d18b99f3a9038683045b2f2338a7706d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b06cdf3e688b98fcc9945873b5d42792bd4eee0\",\"lessThan\":\"a9340ebdc13f8bb5063c0bc0b037ee7e640d4ae9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b06cdf3e688b98fcc9945873b5d42792bd4eee0\",\"lessThan\":\"f833821e4b52ab6335d443ede5fb79c38e61d19a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b06cdf3e688b98fcc9945873b5d42792bd4eee0\",\"lessThan\":\"f0ab9a71167bae308e05ab13b65e2007504a603f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b06cdf3e688b98fcc9945873b5d42792bd4eee0\",\"lessThan\":\"8dd8929b71c4f06c614f8f54c2cc070453faae16\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b06cdf3e688b98fcc9945873b5d42792bd4eee0\",\"lessThan\":\"0ea8f06454012d9e7f9c6e6253df710949bf6294\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b06cdf3e688b98fcc9945873b5d42792bd4eee0\",\"lessThan\":\"96b678d08268b5f5c6fc99d4289d9b7e334fc683\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b06cdf3e688b98fcc9945873b5d42792bd4eee0\",\"lessThan\":\"c283e9ada7fcb7dd4b10592623086b2e6d2f9925\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"72f157be2f81910ae759bfe2e5c2256fc4625645\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9e9fe58a92a46c6d154d2901735bf230d91b8507\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"adc1ec6cdc20d430aa01b86497220709b9149466\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b54033eb1cfd77aba471269ddd804ed8d3e35dea\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c9e82cb34c3c2ee895af01bc899c6ed0bc6eb04a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5eef9b51114fcc65651d671add52f267f91b9451\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3.16.52\",\"lessThan\":\"3.17\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.4.163\",\"lessThan\":\"4.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.18.101\",\"lessThan\":\"3.19\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.1.52\",\"lessThan\":\"4.2\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.4.123\",\"lessThan\":\"4.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.9.89\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/xfrm/xfrm_state.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.267\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.218\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.185\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.154\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.106\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.47\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0ea8f06454012d9e7f9c6e6253df710949bf6294\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8dd8929b71c4f06c614f8f54c2cc070453faae16\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/96b678d08268b5f5c6fc99d4289d9b7e334fc683\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a9340ebdc13f8bb5063c0bc0b037ee7e640d4ae9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c283e9ada7fcb7dd4b10592623086b2e6d2f9925\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e8686fd8d18b99f3a9038683045b2f2338a7706d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f0ab9a71167bae308e05ab13b65e2007504a603f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f833821e4b52ab6335d443ede5fb79c38e61d19a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:45:09Z",
      "cve": "CVE-2026-64581",
      "id": "CVE-2026-64581",
      "initial_release_date": "2026-08-06T01:06:13Z",
      "product_status:first_fixed": "188",
      "product_status:known_affected": "731",
      "product_status:known_not_affected": "4",
      "product_status:recommended": "46",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64581",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64581.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.