CyberSecBulletin
CVE-2026-64564NVD status: Analyzed

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-64564 is a critical-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions a9ce31be4cb1a5dd82b3e0a1d0c3e7cbdcd31293, a63afa1f9b12d5293cbe0b77fd45dc0632533a13, 2b324ba3494ae958cba16a453e3e71489b4de7fc as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 1.39% chance of exploitation within 30 days, higher than 73% of scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to a9ce31be4cb1a5dd82b3e0a1d0c3e7cbdcd31293 or a63afa1f9b12d5293cbe0b77fd45dc0632533a13 or 2b324ba3494ae958cba16a453e3e71489b4de7fc or fedeb4468987bcaff85fe3061de5ae052d414740, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.265 or 5.15.216 or 6.1.183 or 6.6.148, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux42e30bf3463cd37d73839376662cb79b4d5c416c up to, but not including, a9ce31be4cb1a5dd82b3e0a1d0c3e7cbdcd31293; 42e30bf3463cd37d73839376662cb79b4d5c416c up to, but not including, a63afa1f9b12d5293cbe0b77fd45dc0632533a13; 42e30bf3463cd37d73839376662cb79b4d5c416c up to, but not including, 2b324ba3494ae958cba16a453e3e71489b4de7fc; 42e30bf3463cd37d73839376662cb79b4d5c416c up to, but not including, fedeb4468987bcaff85fe3061de5ae052d414740; 42e30bf3463cd37d73839376662cb79b4d5c416c up to, but not including, 74e8f3e7114f0e26d1b2c4c048044db9fcc27603; 42e30bf3463cd37d73839376662cb79b4d5c416c up to, but not including, 85aca407c560aba81b5ce9d3d6cf94c74077d19b; 42e30bf3463cd37d73839376662cb79b4d5c416c up to, but not including, d136b29bf91dd8e3161281b87de597b7311d9462; 42e30bf3463cd37d73839376662cb79b4d5c416c up to, but not including, 9b2854f86f0b56e9027d68e7a3fc909d1a9b566f; and 1 more rangesa9ce31be4cb1a5dd82b3e0a1d0c3e7cbdcd31293, a63afa1f9b12d5293cbe0b77fd45dc0632533a13, 2b324ba3494ae958cba16a453e3e71489b4de7fc, fedeb4468987bcaff85fe3061de5ae052d414740, 74e8f3e7114f0e26d1b2c4c048044db9fcc27603, 85aca407c560aba81b5ce9d3d6cf94c74077d19b
LinuxLinux Kernel2.6.25 up to, but not including, 5.10.265; 5.11 up to, but not including, 5.15.216; 5.16 up to, but not including, 6.1.183; 6.2 up to, but not including, 6.6.148; 6.7 up to, but not including, 6.12.101; 6.13 up to, but not including, 6.18.42; 6.19 up to, but not including, 7.1.6; 7.25.10.265, 5.15.216, 6.1.183, 6.6.148, 6.12.101, 6.18.42

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, set once in sctp_rcv()). For an ASCONF located through its Address Parameter by __sctp_rcv_asconf_lookup(), that cached transport corresponds to the Address Parameter, which need not be the packet's source address. sctp_process_asconf_param() rejects a DEL-IP for the packet source address (ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport. A single ASCONF can therefore carry, in order: [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0] where L differs from the source. The DEL-IP for L passes the D8 check and calls sctp_assoc_rm_peer() on the transport that asconf->transport still points at, freeing it (RCU-deferred). The following wildcard DEL-IP then reuses the now-dangling asconf->transport in sctp_assoc_set_primary() and sctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed transport (->ipaddr, ->state) and plants the dangling pointer into asoc->peer.primary_path / active_path, and del_nonprimary_peers(), keeping only the pointer that is no longer on the list, removes every real transport, leaving the association with a transport_count of 0 and primary_path/active_path pointing at freed memory. Reject a DEL-IP that targets the transport the ASCONF is being processed against, mirroring the existing source-address guard, so the wildcard branch can never reuse a freed transport.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Technical write-ups (may include proof of concept)

Recent Use After Free vulnerabilities

Spotted an error? Tell us.