Linux: Improper Synchronization
CVE-2026-64312 is a high-severity improper synchronization vulnerability in Linux, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 81ce16d938db9b88cdc231522c0358395ae8c6b5, 3920c5f6edc341729d20d0507e466c6d3b11f372, ae93c5b3e2a2968b56d772ca1d06615927b7cc36 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.5% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 81ce16d938db9b88cdc231522c0358395ae8c6b5 or 3920c5f6edc341729d20d0507e466c6d3b11f372 or ae93c5b3e2a2968b56d772ca1d06615927b7cc36 or 82789a44415e3e31168229421b138278dfb16412, whichever matches your release line, or a later version.
- Update Linux Kernel to 4.20 or 5.5 or 5.10.261 or 5.15.212, whichever matches your release line, or a later version.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | a92ccd3618e42333ac6f150ecdac14dca298bc7a up to, but not including, 81ce16d938db9b88cdc231522c0358395ae8c6b5; 96001f52ae8c70e2c736d3e1e5dc53d5b521e5ca up to, but not including, 3920c5f6edc341729d20d0507e466c6d3b11f372; 92834692a539b5b7f409e467a14667d64713b732 up to, but not including, ae93c5b3e2a2968b56d772ca1d06615927b7cc36; 5edae7a9a35606017ee6e05911c290acee9fee5a up to, but not including, 82789a44415e3e31168229421b138278dfb16412; 7ddab756f2de5b7b43c122ebebdf37f400fb2b6f up to, but not including, 4711ca06bd169a2cbc9cc59a6de2ed512c41a880; 662f2f13e66d3883b9238b0b96b17886179e60e2 up to, but not including, c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf; 662f2f13e66d3883b9238b0b96b17886179e60e2 up to, but not including, 83fa1397d5853de1e27dd52ec44b068ff358ca18; 662f2f13e66d3883b9238b0b96b17886179e60e2 up to, but not including, ed459fe319376e876de433d12b6c6772e612ca36; and 12 more ranges | 81ce16d938db9b88cdc231522c0358395ae8c6b5, 3920c5f6edc341729d20d0507e466c6d3b11f372, ae93c5b3e2a2968b56d772ca1d06615927b7cc36, 82789a44415e3e31168229421b138278dfb16412, 4711ca06bd169a2cbc9cc59a6de2ed512c41a880, c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf |
| Linux | Linux Kernel | 4.19.325 up to, but not including, 4.20; 5.4.287 up to, but not including, 5.5; 5.10.231 up to, but not including, 5.10.261; 5.15.174 up to, but not including, 5.15.212; 6.1.120 up to, but not including, 6.1.178; 6.6.64 up to, but not including, 6.6.145; 6.11.11 up to, but not including, 6.12; 6.12.2 up to, but not including, 6.12.96; and 2 more ranges | 4.20, 5.5, 5.10.261, 5.15.212, 6.1.178, 6.6.145 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- NoneNo data is disclosed.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - restore callback for non-parallel fallback pcrypt installs pcrypt_aead_done() on the child AEAD request before trying to submit it through padata. If padata_do_parallel() returns -EBUSY, pcrypt falls back to calling the child AEAD directly. That fallback must not keep the padata completion callback. Otherwise an asynchronous completion runs pcrypt_aead_done() even though the request was never enrolled in padata. Restore the original request callback and callback data before calling the child AEAD directly. This keeps the fallback path aligned with a direct AEAD request while leaving the parallel path unchanged.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Synchronization
The product utilizes multiple threads, processes, components, or systems to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.
How developers prevent this class of flaw
- Use industry standard APIs to synchronize your code.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/3920c5f6edc341729d20d0507e466c6d3b11f372
- git.kernel.org/stable/c/4711ca06bd169a2cbc9cc59a6de2ed512c41a880
- git.kernel.org/stable/c/81ce16d938db9b88cdc231522c0358395ae8c6b5
- git.kernel.org/stable/c/82789a44415e3e31168229421b138278dfb16412
- git.kernel.org/stable/c/83fa1397d5853de1e27dd52ec44b068ff358ca18
- git.kernel.org/stable/c/ae93c5b3e2a2968b56d772ca1d06615927b7cc36
- git.kernel.org/stable/c/c4bd2f4c35b0e15b6040c2f7e7e7986780c066cf
- git.kernel.org/stable/c/ed459fe319376e876de433d12b6c6772e612ca36
Recent Improper Synchronization vulnerabilities
- 8.8 High severity
- 8.2 High severity
- 7.8 High severity
- 9.8 Critical severity
- 7.5 High severity
- 9.1 Critical severity
Spotted an error? Tell us.