{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-64563 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-64563 is a high-severity use after free vulnerability in Linux, published on 4 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-64563 and fix it if it is affected.\n\nWhat it is: CVE-2026-64563 is a high-severity use after free vulnerability in Linux, published on 4 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-64563 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-64563/ (Markdown: https://insights.sbomify.com/CVE-2026-64563/index.md)","id":"CVE-2026-64563","markdown":"https://insights.sbomify.com/CVE-2026-64563/index.md","name":"CVE-2026-64563","record":{"aliases":["AZL-94371","BELL-CVE-2026-64563","DEBIAN-CVE-2026-64563","GHSA-8g97-85g6-9whw","UBUNTU-CVE-2026-64563"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service","code_execution"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A use-after-free in the Linux kernel rhashtable allows attackers to cause a crash or potentially execute code via netlink or TIPC sockets.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrhashtable: clear stale iter-\u003ep on table restart\n\nrhashtable_walk_start_check() has two restart paths when resuming a walk.\nWhen iter-\u003ewalker.tbl is valid, it re-validates iter-\u003ep against the table\nand sets iter-\u003ep = NULL if the object is gone.  When iter-\u003ewalker.tbl is\nNULL (table was freed during resize), it resets slot and skip but forgets\nto clear iter-\u003ep.\n\nrhashtable_walk_next() then dereferences the stale iter-\u003ep, reading\nfreed memory.  This is a use-after-free.\n\nAny caller that does multi-fragment rhashtable walks across\nwalk_stop/walk_start boundaries is affected.  Concrete cases include\nnetlink_diag (__netlink_diag_dump in net/netlink/diag.c) and TIPC\n(tipc_nl_sk_walk in net/tipc/socket.c).\n\nCrash stack (netlink_diag):\n  BUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365/0x3c0\n  Read of size 8 at addr ffff88801a9d2438 (freed kmalloc-2k, offset 1080)\n  Call Trace:\n   rhashtable_walk_next+0x365/0x3c0 (lib/rhashtable.c:1016)\n   __netlink_diag_dump+0x160/0x760 (net/netlink/diag.c:122)\n   netlink_diag_dump+0xc2/0x240\n   netlink_dump+0x5bc/0x1270\n   netlink_recvmsg+0x7a3/0x980\n   sock_recvmsg+0x1bc/0x200\n   __sys_recvfrom+0x1d4/0x2c0","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":"2026-08-12","github_poc":1,"max_poc_stars":0,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-08-12T16:35:16Z","kind":"github_poc","ref":"https://github.com/guard-wait/CVE-2026-64563_EXP","stars":0,"title":"关于CVE-2026-64563未完全验证的一种利用思路"}],"tier":"poc_unverified"},"has_fix":true,"headline":"rhashtable: clear stale iter-\u003ep on table restart","id":"CVE-2026-64563","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"sctp: don't free the ASCONF's own transport in DEL-IP processing","id":"CVE-2026-64564"},"packages":[],"prev":{"headline":"KVM: nVMX: Hide shadow VMCS right after VMCLEAR","id":"CVE-2026-64562"},"products":["Linux"],"published":"2026-08-04","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A use-after-free in the Linux kernel rhashtable allows attackers to cause a crash or potentially execute code via netlink or TIPC sockets.","url":"https://insights.sbomify.com/CVE-2026-64563/"}