CVE-2026-64075

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel fprobe

Publication date: 2026-07-19

Last updated on: 2026-09-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: fprobe: Fix unregister_fprobe() to wait for RCU grace period Commit 4346ba1604093 ("fprobe: Rewrite fprobe on function-graph tracer") changed fprobe to register struct fprobe to an rcu-hlist, but it forgot to wait for RCU GP. Thus there can be use-after-free if the fprobe is released right after unregistering. This can be happened on fprobe event and sample module code. To fix this issue, add synchronize_rcu() in unregister_fprobe(). Note that BPF is OK because fprobe is used as a part of bpf_kprobe_multi_link. This unregisters its fprobe in bpf_kprobe_multi_link_release() and it is deallocated via bpf_kprobe_multi_link_dealloc(), which is invoked from bpf_link_defer_dealloc_rcu_gp() RCU callback. For BPF, this also introduced unregister_fprobe_async() which does NOT wait for RCU grace priod.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-09-03

Generated

2026-09-18

AI Q&A

2026-07-19

EPSS Evaluated

2026-09-15

NVD

CVE-2026-64075

EUVD

EUVD-2026-45648

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.14 (inc) to 6.18.34 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's fprobe component. It involves a missing RCU (Read-Copy-Update) grace period wait during unregistering of an fprobe instance. This can lead to a use-after-free condition if the fprobe is released immediately after unregistering, potentially causing memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's fprobe functionality and requires kernel-level inspection. Detection involves checking kernel logs for fprobe-related errors or crashes after unregistering fprobe. Use commands like dmesg | grep fprobe or journalctl -k | grep fprobe to search for related errors.

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause a system crash or execute arbitrary code with kernel privileges. It primarily affects systems using fprobe for function tracing or BPF (e.g., kprobe-based tools). Users running affected kernel versions should apply the provided patch to mitigate the risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves a use-after-free issue in the Linux kernel's fprobe functionality due to missing RCU grace period handling during unregistering. No evidence suggests this impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Apply the kernel patch that adds synchronize_rcu() in unregister_fprobe() to prevent use-after-free. Update to a kernel version containing the fix (commit 4346ba1604093 or later). For BPF users, ensure bpf_kprobe_multi_link_release() is used correctly.

Hi! I’m here to help you understand CVE-2026-64075. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70