CVE-2026-64075
Received Received - Intake

Use-After-Free in Linux Kernel fprobe

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fprobe: Fix unregister_fprobe() to wait for RCU grace period Commit 4346ba1604093 ("fprobe: Rewrite fprobe on function-graph tracer") changed fprobe to register struct fprobe to an rcu-hlist, but it forgot to wait for RCU GP. Thus there can be use-after-free if the fprobe is released right after unregistering. This can be happened on fprobe event and sample module code. To fix this issue, add synchronize_rcu() in unregister_fprobe(). Note that BPF is OK because fprobe is used as a part of bpf_kprobe_multi_link. This unregisters its fprobe in bpf_kprobe_multi_link_release() and it is deallocated via bpf_kprobe_multi_link_dealloc(), which is invoked from bpf_link_defer_dealloc_rcu_gp() RCU callback. For BPF, this also introduced unregister_fprobe_async() which does NOT wait for RCU grace priod.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64075
EUVD
EUVD-2026-45648

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's fprobe component. It involves a missing RCU (Read-Copy-Update) grace period wait during unregistering of an fprobe instance. This can lead to a use-after-free condition if the fprobe is released immediately after unregistering, potentially causing memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's fprobe functionality and requires kernel-level inspection. Detection involves checking kernel logs for fprobe-related errors or crashes after unregistering fprobe. Use commands like dmesg | grep fprobe or journalctl -k | grep fprobe to search for related errors.

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause a system crash or execute arbitrary code with kernel privileges. It primarily affects systems using fprobe for function tracing or BPF (e.g., kprobe-based tools). Users running affected kernel versions should apply the provided patch to mitigate the risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves a use-after-free issue in the Linux kernel's fprobe functionality due to missing RCU grace period handling during unregistering. No evidence suggests this impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Apply the kernel patch that adds synchronize_rcu() in unregister_fprobe() to prevent use-after-free. Update to a kernel version containing the fix (commit 4346ba1604093 or later). For BPF users, ensure bpf_kprobe_multi_link_release() is used correctly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64075. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart