CyberSecBulletin
CVE-2026-64007NVD status: Modified

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-64007 is a critical-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 9902a1058992de5d95656b64a3bd95c077f7ba2c, d3019c61799adc21811af4b521f11f3dc77f8e04, dd206819f210522579010d889d45a9530bb494bc as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.51% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to 9902a1058992de5d95656b64a3bd95c077f7ba2c or d3019c61799adc21811af4b521f11f3dc77f8e04 or dd206819f210522579010d889d45a9530bb494bc or af2c22ccb1f621aff487ff47a040e38e058541e7, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.259 or 5.15.210 or 6.1.176 or 6.6.143, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux48b1de4c110a7afa4b85862f6c75af817db26fad up to, but not including, 9902a1058992de5d95656b64a3bd95c077f7ba2c; 48b1de4c110a7afa4b85862f6c75af817db26fad up to, but not including, d3019c61799adc21811af4b521f11f3dc77f8e04; 48b1de4c110a7afa4b85862f6c75af817db26fad up to, but not including, dd206819f210522579010d889d45a9530bb494bc; 48b1de4c110a7afa4b85862f6c75af817db26fad up to, but not including, af2c22ccb1f621aff487ff47a040e38e058541e7; 48b1de4c110a7afa4b85862f6c75af817db26fad up to, but not including, c7f945f7da097245a2f8ed7775ce48421047ee96; 48b1de4c110a7afa4b85862f6c75af817db26fad up to, but not including, f0fea2b6d5453a11ad11713bbf37561b9b3a7edf; 48b1de4c110a7afa4b85862f6c75af817db26fad up to, but not including, a91887a5b6ee4b98dfbf1db657ed2b879430149e; 48b1de4c110a7afa4b85862f6c75af817db26fad up to, but not including, 92170e6afe927ab2792a3f71902845789c8e31b1; and 1 more ranges9902a1058992de5d95656b64a3bd95c077f7ba2c, d3019c61799adc21811af4b521f11f3dc77f8e04, dd206819f210522579010d889d45a9530bb494bc, af2c22ccb1f621aff487ff47a040e38e058541e7, c7f945f7da097245a2f8ed7775ce48421047ee96, f0fea2b6d5453a11ad11713bbf37561b9b3a7edf
LinuxLinux Kernel3.12 up to, but not including, 5.10.259; 5.11 up to, but not including, 5.15.210; 5.16 up to, but not including, 6.1.176; 6.2 up to, but not including, 6.6.143; 6.7 up to, but not including, 6.12.93; 6.13 up to, but not including, 6.18.35; 6.19 up to, but not including, 7.0.12; 7.15.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() rewrites the TCP timestamp option in place and then patches the TCP checksum via inet_proto_csum_replace4() on the caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and ipv6_synproxy_hook() obtain that pointer with skb_header_pointer() before calling in, so it may either alias skb->head directly or point at the caller's on-stack _tcph buffer. Between obtaining the pointer and using it, the function calls skb_ensure_writable(skb, optend), which on a cloned or non-linear skb invokes pskb_expand_head() and frees the old skb->head. After that point the cached th is stale: caller (ipv[46]_synproxy_hook) th = skb_header_pointer(skb, ..., &_tcph) synproxy_tstamp_adjust(skb, protoff, th, ...) skb_ensure_writable(skb, optend) pskb_expand_head() /* kfree(old skb->head) */ ... inet_proto_csum_replace4(&th->check, ...) /* writes into freed head, or into the caller's stack copy leaving the on-wire checksum stale */ The option bytes are written through skb->data and are fine; only the checksum update goes through th and so lands in the wrong place. The result is either a write into freed slab memory or a packet leaving with a checksum that does not match its payload. Fix by re-deriving th from skb->data + protoff immediately after skb_ensure_writable() succeeds, so the subsequent checksum update targets the linear, writable header.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.