« Back to list

CVE-2026-64002

Status: Awaiting AnalysisHigh (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

ipv4_sysctl_exit_net() is currently freeing net->ipv4.sysctl_local_reserved_ports too soon.

Only after unregister_net_sysctl_table() we can be sure no threads can possibly use the sysctls, including /proc/sys/net/ipv4/ip_local_reserved_ports.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Vulnerabilidad de acceso local (AV:L, PR:L) en kernel Linux sin interacción; use-after-free que permite DoS por null pointer dereference tras liberar memoria de forma prematura en sysctls de red.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Threat Intelligence ProgramFilter Network TrafficExecution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate Software

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Linux — Linux KernelAI

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-64002",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "122ff243f5f104194750ecbc76d5946dd1eec934",
              "lessThan": "ecf45080a4d3f4526cacb8b14060fe3b49a6913b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "122ff243f5f104194750ecbc76d5946dd1eec934",
              "lessThan": "a0ffc6081a8b27082dd5eae5aa1e3f59bbecf06c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "122ff243f5f104194750ecbc76d5946dd1eec934",
              "lessThan": "5b23a2ff379e70b6b9ff744a972b63e1f8f4d996",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "122ff243f5f104194750ecbc76d5946dd1eec934",
              "lessThan": "8e59d4d0dcde2dfb07a7ef855c849a2a0560aa57",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "122ff243f5f104194750ecbc76d5946dd1eec934",
              "lessThan": "6512c57c4638ddec113bf42439361ba85a12048d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "122ff243f5f104194750ecbc76d5946dd1eec934",
              "lessThan": "a7f4eefb6e1458431eef9fa20fb363320d185f76",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "122ff243f5f104194750ecbc76d5946dd1eec934",
              "lessThan": "155f90be5ee8be5b110ebc0b7da33c54c83b0208",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "122ff243f5f104194750ecbc76d5946dd1eec934",
              "lessThan": "87a1e0fe7776da7ab411be332b4be58ac8840d10",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/ipv4/sysctl_net_ipv4.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.16",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.*"
            },
            {
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/ipv4/sysctl_net_ipv4.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-07-19T16:17:39.807",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/155f90be5ee8be5b110ebc0b7da33c54c83b0208",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5b23a2ff379e70b6b9ff744a972b63e1f8f4d996",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6512c57c4638ddec113bf42439361ba85a12048d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/87a1e0fe7776da7ab411be332b4be58ac8840d10",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8e59d4d0dcde2dfb07a7ef855c849a2a0560aa57",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a0ffc6081a8b27082dd5eae5aa1e3f59bbecf06c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a7f4eefb6e1458431eef9fa20fb363320d185f76",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ecf45080a4d3f4526cacb8b14060fe3b49a6913b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()\n\nipv4_sysctl_exit_net() is currently freeing net->ipv4.sysctl_local_reserved_ports\ntoo soon.\n\nOnly after unregister_net_sysctl_table() we can be sure no threads can possibly\nuse the sysctls, including /proc/sys/net/ipv4/ip_local_reserved_ports."
    }
  ],
  "lastModified": "2026-07-30T14:51:11.223",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}