CyberSecBulletin
CVE-2026-64025NVD status: Modified

Linux: Concurrent Execution using Shared Resource with Improper Synchronization

Published Updated By the CyberSecBulletin desk

CVE-2026-64025 is a critical-severity concurrent execution using shared resource with improper synchronization vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions d698bdba0f9969a6e390d1b1a9a3e283f1f174a7, c9ea01768903ae47f210cd457af1dead6de7a9c3, 7c8cf21bc4efb4af18d6096db3f8bd06d622251c as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.37% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to d698bdba0f9969a6e390d1b1a9a3e283f1f174a7 or c9ea01768903ae47f210cd457af1dead6de7a9c3 or 7c8cf21bc4efb4af18d6096db3f8bd06d622251c or 1861d369efd62d67796563bf3e01fc22e5626f8b, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 6.6.142 or 6.12.92 or 6.18.34 or 7.0.11, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxef5659280eb13e8ac31c296f58cfdfa1684ac06b up to, but not including, d698bdba0f9969a6e390d1b1a9a3e283f1f174a7; ef5659280eb13e8ac31c296f58cfdfa1684ac06b up to, but not including, c9ea01768903ae47f210cd457af1dead6de7a9c3; ef5659280eb13e8ac31c296f58cfdfa1684ac06b up to, but not including, 7c8cf21bc4efb4af18d6096db3f8bd06d622251c; ef5659280eb13e8ac31c296f58cfdfa1684ac06b up to, but not including, 1861d369efd62d67796563bf3e01fc22e5626f8b; ef5659280eb13e8ac31c296f58cfdfa1684ac06b up to, but not including, 8a52139560f833c3975032e1f5762611e3a36d71; ef5659280eb13e8ac31c296f58cfdfa1684ac06b up to, but not including, ddf8029623a1af20e984c040e89ff918158397ab; 5.10d698bdba0f9969a6e390d1b1a9a3e283f1f174a7, c9ea01768903ae47f210cd457af1dead6de7a9c3, 7c8cf21bc4efb4af18d6096db3f8bd06d622251c, 1861d369efd62d67796563bf3e01fc22e5626f8b, 8a52139560f833c3975032e1f5762611e3a36d71, ddf8029623a1af20e984c040e89ff918158397ab
LinuxLinux Kernel5.10 up to, but not including, 6.6.142; 6.7 up to, but not including, 6.12.92; 6.13 up to, but not including, 6.18.34; 6.19 up to, but not including, 7.0.11; 7.16.6.142, 6.12.92, 6.18.34, 7.0.11

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx sk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and defers to psock->saved_data_ready when a TLS RX context is present, avoiding a conflict with the TLS strparser's ownership of the receive queue (commit e91de6afa81c, "bpf: Fix running sk_skb program types with ktls"). sk_psock_verdict_data_ready() has no equivalent guard. When a socket is inserted into a sockmap (BPF_SK_SKB_VERDICT) before TLS RX is configured, tls_sw_strparser_arm() saves sk_psock_verdict_data_ready as rx_ctx->saved_data_ready. On data arrival: tls_data_ready -> tls_strp_data_ready -> tls_rx_msg_ready -> saved_data_ready() = sk_psock_verdict_data_ready() -> tcp_read_skb() drains sk_receive_queue via __skb_unlink() without calling tcp_eat_skb(), so copied_seq is not advanced. tls_strp_msg_load() then finds tcp_inq() >= full_len (stale), calls tcp_recv_skb() on the now-empty queue, hits WARN_ON_ONCE(!first), and returns with rx_ctx->strp.anchor.frag_list pointing at a psock-owned (potentially freed) skb. tls_decrypt_sg() subsequently walks that frag_list: use-after-free. Apply the same fix as sk_psock_strp_data_ready(): if a TLS RX context is present, call psock->saved_data_ready (sock_def_readable) to wake recv() waiters and return immediately, leaving the receive queue untouched. TLS retains sole ownership of the queue and decrypts the record normally through tls_sw_recvmsg().

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Concurrent Execution using Shared Resource with Improper Synchronization

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

How developers prevent this class of flaw

  • In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
  • Use thread-safe capabilities such as the data access abstraction in Spring.
  • Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring. Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).

More Concurrent Execution using Shared Resource with Improper Synchronization vulnerabilities (CWE-362)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Concurrent Execution using Shared Resource with Improper Synchronization vulnerabilities

Spotted an error? Tell us.