CVE-2026-64015

Analyzed Analyzed - Analysis Complete

RCU Read Section Bypass in Linux Kernel Keyring

Publication date: 2026-07-19

Last updated on: 2026-10-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: security/keys: fix missed RCU read section on lookup Nicholas Carlini reports that the keyring code calls assoc_array_find() in find_key_to_update() without holding the RCU read lock, while the assoc_array_gc() code really is designed around removing the node from the tree and then freeing it after an RCU grace-period. The regular key handling doesn't see this because holding the keyring semaphore hides any lifetime issues, but the persistent key handling uses a different model. Instead of extending the keyring locking, just do the simple RCU locking that the assoc_array was designed for.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-07

NVD

CVE-2026-64015

EUVD

EUVD-2026-45588

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.7 (inc) to 6.12.92 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.142 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	From 3.13 (inc) to 6.1.175 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a missing RCU (Read-Copy-Update) read lock in the keyring code. Specifically, the find_key_to_update() function calls assoc_array_find() without holding the RCU read lock, which can lead to issues when assoc_array_gc() removes a node from the tree and frees it after an RCU grace period. The persistent key handling is affected because it uses a different model than regular key handling.

Detection Guidance

This vulnerability is specific to the Linux kernel's keyring subsystem and requires kernel-level inspection. Detection involves checking kernel logs for keyring-related errors or using kernel debugging tools like ftrace or perf to monitor assoc_array_find() calls without RCU locks. Commands may include examining dmesg for RCU warnings or using bpftrace to trace kernel function calls.

Impact Analysis

This vulnerability could potentially lead to memory corruption or use-after-free issues in the Linux kernel, which might cause system crashes or unexpected behavior. Attackers could exploit this to gain unauthorized access or escalate privileges on affected systems.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to RCU read section handling in keyring code, which could lead to memory corruption or use-after-free scenarios. Compliance impacts would only occur if such issues caused data breaches or unauthorized access, which is not specified here.

Mitigation Strategies

Apply the latest kernel security patches from your Linux distribution to resolve the RCU read section issue in the keyring code. Reboot the system after patching to ensure the updated kernel is active. Monitor kernel logs for any persistent keyring-related errors post-update.

Hi! I’m here to help you understand CVE-2026-64015. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70