CVE-2026-64563
Detail
Received This CVE record has recently been published to the CVE List and has been included within the NVD dataset.
Description
In the Linux kernel, the following vulnerability has been resolved:
rhashtable: clear stale iter->p on table restart
rhashtable_walk_start_check() has two restart paths when resuming a walk.
When iter->walker.tbl is valid, it re-validates iter->p against the table
and sets iter->p = NULL if the object is gone. When iter->walker.tbl is
NULL (table was freed during resize), it resets slot and skip but forgets
to clear iter->p.
rhashtable_walk_next() then dereferences the stale iter->p, reading
freed memory. This is a use-after-free.
Any caller that does multi-fragment rhashtable walks across
walk_stop/walk_start boundaries is affected. Concrete cases include
netlink_diag (__netlink_diag_dump in net/netlink/diag.c) and TIPC
(tipc_nl_sk_walk in net/tipc/socket.c).
Crash stack (netlink_diag):
BUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365/0x3c0
Read of size 8 at addr ffff88801a9d2438 (freed kmalloc-2k, offset 1080)
Call Trace:
rhashtable_walk_next+0x365/0x3c0 (lib/rhashtable.c:1016)
__netlink_diag_dump+0x160/0x760 (net/netlink/diag.c:122)
netlink_diag_dump+0xc2/0x240
netlink_dump+0x5bc/0x1270
netlink_recvmsg+0x7a3/0x980
sock_recvmsg+0x1bc/0x200
__sys_recvfrom+0x1d4/0x2c0
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 4.0 Severity and Vector Strings:
NVD assessment
not yet provided.
CVSS 3.x Severity and Vector Strings:
NVD assessment
not yet provided.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 Severity and Vector Strings:
NVD assessment
not yet provided.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected]
Change History
5 change records found show changes
CVE Modified by kernel.org
8/19/2026 1:20:16 PM
Action
Type
Old Value
New Value
Added
Reference
https://git.kernel.org/stable/c/0955b65c2b47c30b439e2cf1b1e375073aa0413a
Added
Reference
https://git.kernel.org/stable/c/a0406c40c6638c5ae50257db6297b2fba6c9ba16
Added
Reference
https://git.kernel.org/stable/c/ba510b5e9fe396497d31162acb579f210adfe6c8
Changed
Affected
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["lib/rhashtable.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"c39643ad99fea749be50615550e8f0e6d6e60694","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"042fda5c088015f18838e5c692659a7be60aeb26","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"3ff7c1dbf722cf3fa538672452ba182318e0fcc3","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"4169d9fb92f313ff8e7e83d733c1ecdcc93eebd3","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"8173f7e2ce67e6ca1d4763f3da14e5b01ce77456","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["lib/rhashtable.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.18","status":"affected"},{"version":"0","lessThan":"4.18","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]
Record truncated, showing 2048 of 2445 characters.
View Entire Change Record [{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["lib/rhashtable.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"ba510b5e9fe396497d31162acb579f210adfe6c8","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"a0406c40c6638c5ae50257db6297b2fba6c9ba16","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"0955b65c2b47c30b439e2cf1b1e375073aa0413a","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"c39643ad99fea749be50615550e8f0e6d6e60694","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"042fda5c088015f18838e5c692659a7be60aeb26","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"3ff7c1dbf722cf3fa538672452ba182318e0fcc3","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"4169d9fb92f313ff8e7e83d733c1ecdcc93eebd3","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"8173f7e2ce67e6ca1d4763f3da14e5b01ce77456","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["lib/rhashtable.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.18","status":"affected"},{"version":"0","lessThan":"4.18","versionType":"semver","status":"unaffected"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"
CVE Modified by kernel.org
8/17/2026 1:18:02 AM
Action
Type
Old Value
New Value
Changed
Affected
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["lib/rhashtable.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"c39643ad99fea749be50615550e8f0e6d6e60694","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"042fda5c088015f18838e5c692659a7be60aeb26","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"3ff7c1dbf722cf3fa538672452ba182318e0fcc3","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"4169d9fb92f313ff8e7e83d733c1ecdcc93eebd3","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"8173f7e2ce67e6ca1d4763f3da14e5b01ce77456","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["lib/rhashtable.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.18","status":"affected"},{"version":"0","lessThan":"4.18","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc5","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["lib/rhashtable.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"c39643ad99fea749be50615550e8f0e6d6e60694","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"042fda5c088015f18838e5c692659a7be60aeb26","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"3ff7c1dbf722cf3fa538672452ba182318e0fcc3","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"4169d9fb92f313ff8e7e83d733c1ecdcc93eebd3","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"8173f7e2ce67e6ca1d4763f3da14e5b01ce77456","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["lib/rhashtable.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.18","status":"affected"},{"version":"0","lessThan":"4.18","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]
CVE Modified by kernel.org
8/09/2026 3:17:02 PM
Action
Type
Old Value
New Value
Added
Reference
https://git.kernel.org/stable/c/042fda5c088015f18838e5c692659a7be60aeb26
Added
Reference
https://git.kernel.org/stable/c/c39643ad99fea749be50615550e8f0e6d6e60694
Changed
Affected
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["lib/rhashtable.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"3ff7c1dbf722cf3fa538672452ba182318e0fcc3","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"4169d9fb92f313ff8e7e83d733c1ecdcc93eebd3","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"8173f7e2ce67e6ca1d4763f3da14e5b01ce77456","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["lib/rhashtable.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.18","status":"affected"},{"version":"0","lessThan":"4.18","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc5","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["lib/rhashtable.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"c39643ad99fea749be50615550e8f0e6d6e60694","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"042fda5c088015f18838e5c692659a7be60aeb26","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"3ff7c1dbf722cf3fa538672452ba182318e0fcc3","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"4169d9fb92f313ff8e7e83d733c1ecdcc93eebd3","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"8173f7e2ce67e6ca1d4763f3da14e5b01ce77456","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["lib/rhashtable.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.18","status":"affected"},{"version":"0","lessThan":"4.18","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc5","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]
CVE Modified by kernel.org
8/08/2026 11:16:31 AM
Action
Type
Old Value
New Value
Added
CVSS V3.1
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
New CVE Received from kernel.org
8/04/2026 3:16:31 AM
Action
Type
Old Value
New Value
Added
Description
In the Linux kernel, the following vulnerability has been resolved:
rhashtable: clear stale iter->p on table restart
rhashtable_walk_start_check() has two restart paths when resuming a walk.
When iter->walker.tbl is valid, it re-validates iter->p against the table
and sets iter->p = NULL if the object is gone. When iter->walker.tbl is
NULL (table was freed during resize), it resets slot and skip but forgets
to clear iter->p.
rhashtable_walk_next() then dereferences the stale iter->p, reading
freed memory. This is a use-after-free.
Any caller that does multi-fragment rhashtable walks across
walk_stop/walk_start boundaries is affected. Concrete cases include
netlink_diag (__netlink_diag_dump in net/netlink/diag.c) and TIPC
(tipc_nl_sk_walk in net/tipc/socket.c).
Crash stack (netlink_diag):
BUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365/0x3c0
Read of size 8 at addr ffff88801a9d2438 (freed kmalloc-2k, offset 1080)
Call Trace:
rhashtable_walk_next+0x365/0x3c0 (lib/rhashtable.c:1016)
__netlink_diag_dump+0x160/0x760 (net/netlink/diag.c:122)
netlink_diag_dump+0xc2/0x240
netlink_dump+0x5bc/0x1270
netlink_recvmsg+0x7a3/0x980
sock_recvmsg+0x1bc/0x200
__sys_recvfrom+0x1d4/0x2c0
Added
Reference
https://git.kernel.org/stable/c/3ff7c1dbf722cf3fa538672452ba182318e0fcc3
Added
Reference
https://git.kernel.org/stable/c/4169d9fb92f313ff8e7e83d733c1ecdcc93eebd3
Added
Reference
https://git.kernel.org/stable/c/8173f7e2ce67e6ca1d4763f3da14e5b01ce77456
Added
Affected
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["lib/rhashtable.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"3ff7c1dbf722cf3fa538672452ba182318e0fcc3","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"4169d9fb92f313ff8e7e83d733c1ecdcc93eebd3","versionType":"git","status":"affected"},{"version":"5d240a8936f6a1d3ece06701e8c4d830a2eca8a8","lessThan":"8173f7e2ce67e6ca1d4763f3da14e5b01ce77456","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["lib/rhashtable.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.18","status":"affected"},{"version":"0","lessThan":"4.18","versionType":"semver","status":"unaffected"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc5","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]
Quick Info
CVE Dictionary Entry: CVE-2026-64563 NVD
Published Date: 08/04/2026 NVD
Last Modified: 08/19/2026
Source: kernel.org
) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
