Junglewise Threat Intelligence

CVE-2026-64163: Linux kernel denial of service in kprobes sanity tests

CVE-2026-64163 · Severity: info · CVSS 0 · Published 2026-07-19

Technologies: Linux. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's kprobes testing suite can cause the system to crash when diagnostic tests are run multiple times. This component is used by developers and system administrators to verify the integrity of kernel probing mechanisms. While it primarily affects system stability during testing, a kernel crash results in a complete service outage for the affected machine.

Technical details

A vulnerability in `lib/test_kprobes.c` (or `lib/tests/test_kprobes.c`) occurs because kprobes and kretprobes are defined as static variables that retain state across test runs. When the kprobes sanity tests are executed a second time via debugfs, leftover data in the `addr` and `flags` fields causes `register_kprobe` to fail with error -22. Subsequent operations on these uncleared structures lead to an invalid kernel paging request and a system crash. The fix moves the initialization and clearing of these structures into `kprobes_test_init`, ensuring they are reset before every test execution.

Affected products

  • Linux Linux 5.16 to 6.6.142

Timeline

  • 2026-05-08: disclosed: Patch submitted by Martin Kaiser
  • 2026-06-01: patched: Commits merged into stable branches by Greg Kroah-Hartman
  • 2026-07-19: advisory: CVE-2026-64163 published

References