Executive brief
A vulnerability was identified in the Linux kernel's networking component that could lead to system instability. The issue occurs when the system cleans up network settings, potentially allowing the computer to crash or behave unpredictably if certain internal data is accessed while it is being deleted. This primarily affects systems using network namespaces, a common feature in containerized environments.
Technical details
A use-after-free vulnerability exists in net/ipv4/sysctl_net_ipv4.c within the Linux kernel. The function ipv4_sysctl_exit_net() frees 'net->ipv4.sysctl_local_reserved_ports' before calling unregister_net_sysctl_table(). This creates a race condition where other threads or processes accessing /proc/sys/net/ipv4/ip_local_reserved_ports may attempt to use the memory after it has been deallocated. An attacker with local access could potentially exploit this to cause a kernel panic (denial of service). The issue has been resolved in various stable branches by reordering the cleanup sequence to ensure the sysctl table is unregistered before the associated memory is freed.
Affected products
- Linux Linux Kernel 3.16 to 6.10.y
Timeline
- 2026-05-21: disclosed: Initial patch submitted by Eric Dumazet
- 2026-07-19: advisory: CVE-2026-64002 published in NVD
References
- https://git.kernel.org/stable/c/155f90be5ee8be5b110ebc0b7da33c54c83b0208
- https://git.kernel.org/stable/c/5b23a2ff379e70b6b9ff744a972b63e1f8f4d996
- https://git.kernel.org/stable/c/6512c57c4638ddec113bf42439361ba85a12048d
- https://git.kernel.org/stable/c/87a1e0fe7776da7ab411be332b4be58ac8840d10
- https://git.kernel.org/stable/c/8e59d4d0dcde2dfb07a7ef855c849a2a0560aa57
- https://git.kernel.org/stable/c/a0ffc6081a8b27082dd5eae5aa1e3f59bbecf06c
- https://git.kernel.org/stable/c/a7f4eefb6e1458431eef9fa20fb363320d185f76