Linux: Improper Locking
CVE-2026-64004 is a high-severity improper locking vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 884eb247b74d86db97e3a37f0d6fc8e1e83590dd, 45bb8de8c95d8899f4b8f61bd9bceb8132af73cb, 1fc30bd4e55e2dd622d2d366cecd732c1841bbee as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.1% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 884eb247b74d86db97e3a37f0d6fc8e1e83590dd or 45bb8de8c95d8899f4b8f61bd9bceb8132af73cb or 1fc30bd4e55e2dd622d2d366cecd732c1841bbee or cd691beafea0dd779e69e81ccc26b0ab50efcb5e, whichever matches your release line, or a later version.
- Update Linux Kernel to 5.10.259 or 5.15.210 or 6.1.176 or 6.6.143, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 51363b8751a673a00ad48eea895266396d53fa52 up to, but not including, 884eb247b74d86db97e3a37f0d6fc8e1e83590dd; 51363b8751a673a00ad48eea895266396d53fa52 up to, but not including, 45bb8de8c95d8899f4b8f61bd9bceb8132af73cb; 51363b8751a673a00ad48eea895266396d53fa52 up to, but not including, 1fc30bd4e55e2dd622d2d366cecd732c1841bbee; 51363b8751a673a00ad48eea895266396d53fa52 up to, but not including, cd691beafea0dd779e69e81ccc26b0ab50efcb5e; 51363b8751a673a00ad48eea895266396d53fa52 up to, but not including, 6e792b8dd3002bbc4136745928a9605df1a72b8a; 51363b8751a673a00ad48eea895266396d53fa52 up to, but not including, 9817369243380e287ebe5525411557eaa3aa2a79; 51363b8751a673a00ad48eea895266396d53fa52 up to, but not including, 69554adc7a6fa04ede3ad7512321d83748e3c920; 51363b8751a673a00ad48eea895266396d53fa52 up to, but not including, 3589d20a666caf30ad100c960a2de7de390fce88; and 1 more ranges | 884eb247b74d86db97e3a37f0d6fc8e1e83590dd, 45bb8de8c95d8899f4b8f61bd9bceb8132af73cb, 1fc30bd4e55e2dd622d2d366cecd732c1841bbee, cd691beafea0dd779e69e81ccc26b0ab50efcb5e, 6e792b8dd3002bbc4136745928a9605df1a72b8a, 9817369243380e287ebe5525411557eaa3aa2a79 |
| Linux | Linux Kernel | 3.4 up to, but not including, 5.10.259; 5.11 up to, but not including, 5.15.210; 5.16 up to, but not including, 6.1.176; 6.2 up to, but not including, 6.6.143; 6.7 up to, but not including, 6.12.93; 6.13 up to, but not including, 6.18.35; 6.19 up to, but not including, 7.0.12; 7.1 | 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix locking in .getsockopt Mirror iucv_sock_setsockopt() and wrap the whole switch in lock_sock()/release_sock(). The pre-existing SO_MSGLIMIT-only lock becomes redundant and is removed. Any AF_IUCV HIPER user can potentially crash the kernel by racing recvmsg() with getsockopt(SO_MSGSIZE): the SO_MSGSIZE arm dereferences iucv->hs_dev->mtu after iucv_sock_close() (called from the racing recvmsg()) has set hs_dev to NULL, producing a NULL pointer dereference oops.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Locking
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
How developers prevent this class of flaw
- Use industry standard APIs to implement locking mechanism.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/1fc30bd4e55e2dd622d2d366cecd732c1841bbee
- git.kernel.org/stable/c/3589d20a666caf30ad100c960a2de7de390fce88
- git.kernel.org/stable/c/45bb8de8c95d8899f4b8f61bd9bceb8132af73cb
- git.kernel.org/stable/c/69554adc7a6fa04ede3ad7512321d83748e3c920
- git.kernel.org/stable/c/6e792b8dd3002bbc4136745928a9605df1a72b8a
- git.kernel.org/stable/c/884eb247b74d86db97e3a37f0d6fc8e1e83590dd
- git.kernel.org/stable/c/9817369243380e287ebe5525411557eaa3aa2a79
- git.kernel.org/stable/c/cd691beafea0dd779e69e81ccc26b0ab50efcb5e
Recent Improper Locking vulnerabilities
- 7.8 High severity
- 9.8 Critical severity
- 9.8 Critical severity
- 7.8 High severity
- 7.8 High severity
- 8.8 High severity
Spotted an error? Tell us.