{
  "threat_severity" : "Important",
  "public_date" : "2026-08-04T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: rhashtable: clear stale iter->p on table restart",
    "id" : "2510892",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2510892"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.3",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-825",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nrhashtable: clear stale iter->p on table restart\nrhashtable_walk_start_check() has two restart paths when resuming a walk.\nWhen iter->walker.tbl is valid, it re-validates iter->p against the table\nand sets iter->p = NULL if the object is gone.  When iter->walker.tbl is\nNULL (table was freed during resize), it resets slot and skip but forgets\nto clear iter->p.\nrhashtable_walk_next() then dereferences the stale iter->p, reading\nfreed memory.  This is a use-after-free.\nAny caller that does multi-fragment rhashtable walks across\nwalk_stop/walk_start boundaries is affected.  Concrete cases include\nnetlink_diag (__netlink_diag_dump in net/netlink/diag.c) and TIPC\n(tipc_nl_sk_walk in net/tipc/socket.c).\nCrash stack (netlink_diag):\nBUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365/0x3c0\nRead of size 8 at addr ffff88801a9d2438 (freed kmalloc-2k, offset 1080)\nCall Trace:\nrhashtable_walk_next+0x365/0x3c0 (lib/rhashtable.c:1016)\n__netlink_diag_dump+0x160/0x760 (net/netlink/diag.c:122)\nnetlink_diag_dump+0xc2/0x240\nnetlink_dump+0x5bc/0x1270\nnetlink_recvmsg+0x7a3/0x980\nsock_recvmsg+0x1bc/0x200\n__sys_recvfrom+0x1d4/0x2c0", "A flaw was found in the Linux kernel. This vulnerability, known as a use-after-free, occurs in the `rhashtable` component when the system improperly handles hash table restarts. An attacker could potentially exploit this by causing the system to access memory that has already been released, which may lead to a system crash (Denial of Service) or, in more severe scenarios, allow for unauthorized code execution or information disclosure." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-09-08T00:00:00Z",
    "advisory" : "RHSA-2026:64775",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "kernel-0:6.12.0-211.52.1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-09-08T00:00:00Z",
    "advisory" : "RHSA-2026:64770",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::nfv",
    "package" : "kernel-rt-0:4.18.0-553.160.1.rt7.501.el8_10"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-64563\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64563\nhttps://lore.kernel.org/linux-cve-announce/2026080404-CVE-2026-64563-9d7f@gregkh/T" ],
  "name" : "CVE-2026-64563",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}