CVE-2026-64015 security/keys: fix missed RCU read section on lookup
A race condition in the Linux kernel keyring allows attackers to trigger use-after-free errors, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64015?
CVE-2026-64015 is a high-severity vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
security/keys: fix missed RCU read section on lookup
Nicholas Carlini reports that the keyring code calls assoc_array_find() in find_key_to_update() without holding the RCU read lock, while the assoc_array_gc() code really is designed around removing the node from the tree and then freeing it after an RCU grace-period.
The regular key handling doesn't see this because holding the keyring semaphore hides any lifetime issues, but the persistent key handling uses a different model.
Instead of extending the keyring locking, just do the simple RCU locking that the assoc_array was designed for.
Which versions are affected by CVE-2026-64015?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64015?
Apply the vendor's patch.
Is CVE-2026-64015 being exploited?
There is no known exploitation of CVE-2026-64015 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64015, DEBIAN-CVE-2026-64015, GHSA-6rrm-p5j2-8pf8, ROOT-OS-DEBIAN-11-CVE-2026-64015, ROOT-OS-UBUNTU-2204-CVE-2026-64015, UBUNTU-CVE-2026-64015.