Linux: Double Free
CVE-2026-64535 is a critical-severity double free vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions dfb902462bca478f050224ec7a7195aafa7643b1, 7e558308eba14c8136cb1e615f0c850f76d1fc0a, 96fe2513df590e74b04253a45089cae75569570e as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.55% chance of exploitation within 30 days, which is low compared with other CVEs.
Critical severity: a successful attack would have severe impact.
What to do
- Update Linux to dfb902462bca478f050224ec7a7195aafa7643b1 or 7e558308eba14c8136cb1e615f0c850f76d1fc0a or 96fe2513df590e74b04253a45089cae75569570e or e091ff83d962f9ed00d9bd70443676de9fe98bdc, whichever matches your release line, or a later version.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 91edfca6f8b364d60cde3ddefaf7d03ddf35774b up to, but not including, dfb902462bca478f050224ec7a7195aafa7643b1; fda871c0ba5d2eed2cd1c881573168129da70058 up to, but not including, 7e558308eba14c8136cb1e615f0c850f76d1fc0a; fda871c0ba5d2eed2cd1c881573168129da70058 up to, but not including, 96fe2513df590e74b04253a45089cae75569570e; fda871c0ba5d2eed2cd1c881573168129da70058 up to, but not including, e091ff83d962f9ed00d9bd70443676de9fe98bdc; fda871c0ba5d2eed2cd1c881573168129da70058 up to, but not including, 6f9442983a3e4227afd1c83a5251ddbca585ea21; fda871c0ba5d2eed2cd1c881573168129da70058 up to, but not including, 088ee46c18d99baef453afd74181dd40ade044ad; fda871c0ba5d2eed2cd1c881573168129da70058 up to, but not including, dbbd07d0a7020b80f6a7028e561908f7b83b3d5a; 4b17476d809273617d3317fa0d4ae78aa488d760; and 3 more ranges | dfb902462bca478f050224ec7a7195aafa7643b1, 7e558308eba14c8136cb1e615f0c850f76d1fc0a, 96fe2513df590e74b04253a45089cae75569570e, e091ff83d962f9ed00d9bd70443676de9fe98bdc, 6f9442983a3e4227afd1c83a5251ddbca585ea21, 088ee46c18d99baef453afd74181dd40ade044ad |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit() — which performs percpu_ref_put() on the submission queue — but does NOT mark the command as completed. It does not set cqe->status, does not modify rbytes_done, and does not clear any flag. When the subsequent fatal error triggers queue teardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands, checks nvmet_tcp_need_data_in() for each one, and finds that the already-uninited command still appears to need data (because rbytes_done < transfer_len and cqe->status == 0). It therefore calls nvmet_req_uninit() a second time on the same command — a double percpu_ref_put against a single percpu_ref_get.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Double Free
The product calls free() twice on the same memory address.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
- Use a static analysis tool to find double free instances.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Other references
- git.kernel.org/stable/c/088ee46c18d99baef453afd74181dd40ade044ad
- git.kernel.org/stable/c/6f9442983a3e4227afd1c83a5251ddbca585ea21
- git.kernel.org/stable/c/7e558308eba14c8136cb1e615f0c850f76d1fc0a
- git.kernel.org/stable/c/96fe2513df590e74b04253a45089cae75569570e
- git.kernel.org/stable/c/dbbd07d0a7020b80f6a7028e561908f7b83b3d5a
- git.kernel.org/stable/c/dfb902462bca478f050224ec7a7195aafa7643b1
- git.kernel.org/stable/c/e091ff83d962f9ed00d9bd70443676de9fe98bdc
Recent Double Free vulnerabilities
- 7.8 High severity
- 9.8 Critical severity
- 9.8 Critical severity
- 9.8 Critical severity
- 9.8 Critical severity
- 9.8 Critical severity
Spotted an error? Tell us.