CyberSecBulletin
CVE-2026-64032NVD status: Modified

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-64032 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions ddefd1b8e5eb58933a697ab38334f0fd82e7fb8b, ed3b69e60385a03df11c6d12e5d7bdf0f4a11b70, 1900ca8acb92fbea8bf9abef9927c7fed03db7fc as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.13% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to ddefd1b8e5eb58933a697ab38334f0fd82e7fb8b or ed3b69e60385a03df11c6d12e5d7bdf0f4a11b70 or 1900ca8acb92fbea8bf9abef9927c7fed03db7fc or ebe5561154c823b323bd06e350b55e0b8604d851, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.15.209 or 6.1.175 or 6.6.142 or 6.12.92, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux410a033bfa8c7daefbae0225c836693db2149ec1 up to, but not including, ddefd1b8e5eb58933a697ab38334f0fd82e7fb8b; c6d16eab122744df698f18b47cf771945cd55066 up to, but not including, ed3b69e60385a03df11c6d12e5d7bdf0f4a11b70; b4c83b37490d61cfdd62a2b29e98a9b89004b5c0 up to, but not including, 1900ca8acb92fbea8bf9abef9927c7fed03db7fc; 78f768e36c065ca3f88272fcf39014782c2d4ecd up to, but not including, ebe5561154c823b323bd06e350b55e0b8604d851; 4b30ae9adb047dd0a7982975ec3933c529537026 up to, but not including, a9224862d597d0eed0a34bbb27343f703fc4113f; 4b30ae9adb047dd0a7982975ec3933c529537026 up to, but not including, 7213256c91ed778a0997c2029c152b18dc50e4fd; 4b30ae9adb047dd0a7982975ec3933c529537026 up to, but not including, 4df78ff02629c7729168f0696a7a2123c389818d; c996e25df0b3282c724bb5aca434518bc08cd963; and 6 more rangesddefd1b8e5eb58933a697ab38334f0fd82e7fb8b, ed3b69e60385a03df11c6d12e5d7bdf0f4a11b70, 1900ca8acb92fbea8bf9abef9927c7fed03db7fc, ebe5561154c823b323bd06e350b55e0b8604d851, a9224862d597d0eed0a34bbb27343f703fc4113f, 7213256c91ed778a0997c2029c152b18dc50e4fd
LinuxLinux Kernel5.15.186 up to, but not including, 5.15.209; 6.1.142 up to, but not including, 6.1.175; 6.6.95 up to, but not including, 6.6.142; 6.12.35 up to, but not including, 6.12.92; 6.15.4 up to, but not including, 6.18.34; 6.19 up to, but not including, 7.0.11; 7.15.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix a possible use-after-free when removing a bridge port When per-VLAN multicast snooping is enabled, the bridge iterates over all the bridge ports, disables the per-port multicast context on each port and enables the per-{port, VLAN} multicast contexts instead. The reverse happens when per-VLAN multicast snooping is disabled. When global multicast snooping is enabled, the bridge iterates over all the bridge ports and enables the per-port multicast context on each port. The reverse happens when multicast snooping is disabled. The above scheme can result in a situation where both types of contexts (per-port and per-{port, VLAN}) are enabled on a single bridge port: # ip link add name br1 up type bridge mcast_snooping 1 mcast_querier 1 vlan_filtering 1 # ip link add name dummy1 up master br1 type dummy # ip link set dev br1 type bridge mcast_vlan_snooping 1 # ip link set dev br1 type bridge mcast_snooping 0 # ip link set dev br1 type bridge mcast_snooping 1 This is not intended and it is a problem since the commit cited below. Prior to this commit, when removing a bridge port, br_multicast_disable_port() would disable the per-port multicast context and the per-{port, VLAN} multicast contexts would get disabled when flushing VLANs. After this commit, br_multicast_disable_port() only disables the per-port multicast context if per-VLAN multicast snooping is disabled. If both types of contexts were enabled on the port when it was removed, the per-port multicast context would remain enabled when freeing the bridge port, leading to a use-after-free [1]. Fix by preventing the bridge from enabling / disabling the per-port multicast contexts when toggling global multicast snooping if per-VLAN multicast snooping is enabled. [1] ODEBUG: free active (active state 0) object: ffff88810f8bda78 object type: timer_list hint: br_ip6_multicast_port_query_expired (net/bridge/br_multicast.c:1927) WARNING: lib/debugobjects.c:629 at debug_print_object+0x1b1/0x3e0, CPU#5: swapper/5/0 [...] Call Trace: <IRQ> __debug_check_no_obj_freed (lib/debugobjects.c:1116) kfree (mm/slub.c:2620 mm/slub.c:6250 mm/slub.c:6565) kobject_cleanup (lib/kobject.c:689) rcu_do_batch (kernel/rcu/tree.c:2617) rcu_core (kernel/rcu/tree.c:2869) handle_softirqs (kernel/softirq.c:622) __irq_exit_rcu (kernel/softirq.c:656 kernel/softirq.c:496 kernel/softirq.c:735) irq_exit_rcu (kernel/softirq.c:752) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1061 (discriminator 47) arch/x86/kernel/apic/apic.c:1061 (discriminator 47)) </IRQ>

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.