CVE-2026-64163
Received Received - Intake

Kernel Crash Due to Leftover Kprobes in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: test_kprobes: clear kprobes between test runs Running the kprobes sanity tests twice makes all tests fail and eventually crashes the kernel. [root@martin-riscv-1 ~]# echo 1 > /sys/kernel/debug/kunit/kprobes_test/run ... # Totals: pass:5 fail:0 skip:0 total:5 ok 1 kprobes_test [root@martin-riscv-1 ~]# echo 1 > /sys/kernel/debug/kunit/kprobes_test/run ... # test_kprobe: EXPECTATION FAILED at lib/tests/test_kprobes.c:64 Expected 0 == register_kprobe(&kp), but register_kprobe(&kp) == -22 (0xffffffffffffffea) ... Unable to handle kernel paging request ... The testsuite defines several kprobes and kretprobes as static variables that are preserved across test runs. After register_kprobe and unregister_kprobe, a kprobe contains some leftover data that must be cleared before the kprobe can be registered again. The tests are setting symbol_name to define the probe location. Address and flags must be cleared. The existing code clears some of the probes between subsequent tests, but not between two test runs. The leftover data from a previous test run makes the registrations fail in the next run. Move the cleanups for all kprobes into kprobes_test_init, this function is called before each single test (including the first test of a test run).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64163
EUVD
EUVD-2026-45848

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves kprobes sanity tests failing when run multiple times. The issue occurs because leftover data from previous test runs prevents kprobes from being properly registered again, leading to test failures and kernel crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's kprobes test suite and may not have direct network detection methods. Check kernel logs for kprobes-related errors or crashes after running kprobes tests. Commands: dmesg | grep -i kprobe or journalctl -k | grep -i kprobe.

Impact Analysis

If exploited, this vulnerability could cause system instability by crashing the kernel during kprobes testing. It may lead to unexpected reboots or denial of service if the affected tests are run repeatedly in a production environment.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a kernel-level issue causing test failures and crashes during kprobes testing. It does not involve data exposure, unauthorized access, or privacy violations that these regulations typically address.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Ensure kprobes tests are run in a controlled environment and avoid running them multiple times without a system reboot. Monitor kernel logs for kprobes-related failures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64163. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart