Linux: Improper Locking
CVE-2026-64057 is a high-severity improper locking vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 93531bca46707c6c28c4f4eb26c101fa36ccb8cb, 77ea917cbed62882a33114b1e23ededb977e4287, c0410adf3da6db46f3513411fcf95e63c2f1d1ad as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.13% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 93531bca46707c6c28c4f4eb26c101fa36ccb8cb or 77ea917cbed62882a33114b1e23ededb977e4287 or c0410adf3da6db46f3513411fcf95e63c2f1d1ad, whichever matches your release line, or a later version.
- Update Linux Kernel to 7.0.11 or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | eae9e78951bb02a7b94a9adef6e981413d13c564 up to, but not including, 93531bca46707c6c28c4f4eb26c101fa36ccb8cb; eae9e78951bb02a7b94a9adef6e981413d13c564 up to, but not including, 77ea917cbed62882a33114b1e23ededb977e4287; eae9e78951bb02a7b94a9adef6e981413d13c564 up to, but not including, c0410adf3da6db46f3513411fcf95e63c2f1d1ad; 6.14 | 93531bca46707c6c28c4f4eb26c101fa36ccb8cb, 77ea917cbed62882a33114b1e23ededb977e4287, c0410adf3da6db46f3513411fcf95e63c2f1d1ad |
| Linux | Linux Kernel | 6.14 up to, but not including, 7.0.11; 7.1 | 7.0.11 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: afs: Fix the locking used by afs_get_link() The afs filesystem in the kernel doesn't do locking correctly for symbolic links. There are a number of problems: (1) It doesn't do any locking around afs_read_single() to prevent races between multiple ->get_link() calls, thereby allowing the possibility of leaks. (2) It doesn't use RCU barriering when accessing the buffer pointers during RCU pathwalk. (3) It can race with another thread updating the contents of the symlink if a third party updated it on the server. Fix this by the following means: (0) Move symlink handling into its own file as this makes it more complicated. (1) Take the validate_lock around afs_read_single() to prevent races between multiple ->get_link() calls. (2) Keep a separate copy of the symlink contents with an rcu_head. This is always going to be a lot smaller than a page, so it can be kmalloc'd and save quite a bit of memory. It also needs a refcount for non-RCU pathwalk. (3) Split the symlink read and write-to-cache routines in afs from those for directories. (4) Discard the I/O buffer as soon as the write-to-cache completes as this is a full page (plus a folio_queue). (5) If there's no cache, discard the I/O buffer immediately after reading and copying if there is no cache.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Locking
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
How developers prevent this class of flaw
- Use industry standard APIs to implement locking mechanism.
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Other references
Recent Improper Locking vulnerabilities
- 7.8 High severity
- 9.8 Critical severity
- 9.8 Critical severity
- 7.8 High severity
- 7.8 High severity
- 8.8 High severity
Spotted an error? Tell us.