CVE-2026-64435

Awaiting Analysis Awaiting Analysis - Queue

Race Condition in Linux Kernel audit_queue Handling

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skb_queue_len() readers on audit_queue Multiple readers access audit_queue.qlen via skb_queue_len() without holding the queue lock or using READ_ONCE(), while kauditd writes to this field via the skb_dequeue() → __skb_unlink() path with WRITE_ONCE() protected by a spinlock. This constitutes data races. All affected skb_queue_len(&audit_queue) call sites: - kauditd_thread() wait_event_freezable() condition - audit_receive_msg() AUDIT_GET handler (s.backlog assignment) - audit_receive() backlog check - audit_log_start() backlog check and pr_warn() KCSAN reports the following conflicting access pattern (one example): ================================================================== BUG: KCSAN: data-race in audit_log_start / skb_dequeue write (marked) to 0xffffffff8512ee20 of 4 bytes by task 661 on cpu 57: skb_dequeue+0x70/0xf0 kauditd_send_queue+0x71/0x220 kauditd_thread+0x1cb/0x430 kthread+0x1c2/0x210 ret_from_fork+0x162/0x1a0 ret_from_fork_asm+0x1a/0x30 read to 0xffffffff8512ee20 of 4 bytes by task 36586 on cpu 1: audit_log_start+0x2a0/0x6b0 audit_core_dumps+0x64/0xa0 do_coredump+0x14b/0x1260 get_signal+0xeb2/0xf70 arch_do_signal_or_restart+0x41/0x170 exit_to_user_mode_loop+0xa2/0x1c0 do_syscall_64+0x1a3/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0xe0 value changed: 0x00000001 -> 0x00000000 ================================================================== Resolve the race by switching to lockless helper skb_queue_len_lockless(), which internally uses READ_ONCE() and properly pairs with the WRITE_ONCE() write accesses already present on the writer side. [PM: line length tweak]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64435

EUVD

EUVD-2026-48779

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a data race vulnerability in the Linux kernel's audit subsystem. Multiple reader threads access the audit_queue.qlen field without proper synchronization, while the writer thread modifies it under a spinlock. This can lead to inconsistent or corrupted values being read.

Detection Guidance

This vulnerability is specific to the Linux kernel's audit subsystem and involves data races in the audit_queue. Detection requires kernel-level inspection rather than network scanning. Check kernel logs for KCSAN warnings about data races in audit functions or monitor for unusual audit subsystem behavior.

Impact Analysis

The vulnerability could cause incorrect audit log behavior, such as missing logs or incorrect backlog counts. In severe cases, it might lead to system instability or security events being improperly recorded.

Compliance Impact

This vulnerability involves data races in the Linux kernel's audit subsystem, specifically in the handling of audit_queue.qlen. While it does not directly expose or leak data, it could potentially lead to inconsistent state tracking in audit logs, which are critical for compliance reporting. Inaccurate audit logs may impact compliance with standards like GDPR or HIPAA, which require reliable logging for data protection and breach detection.

Mitigation Strategies

Apply the kernel patch that replaces skb_queue_len() with skb_queue_len_lockless() in affected audit functions. Update to a kernel version containing this fix. If immediate patching isn't possible, consider disabling the audit subsystem temporarily as a workaround.

Hi! I’m here to help you understand CVE-2026-64435. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70