Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-64002— ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 3.16版本至7.0.12版本及之前的7.0.x版本存在安全漏洞，该漏洞源于在ipv4_sysctl_exit_net()中过早释放net->ipv4.sysctl_local_reserved_ports，可能导致被其他线程使用。以下版本受到影响：3.16版本、5.10.259版本及之前的5.10.x版本、5.15.210版本及之前的5.15.x版本、6.1.176版本及之前的6.1.x版本、6.6.143

CVSS 7.8 · High EPSS 0.13% · P2

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 122ff243f5f104194750ecbc76d5946dd1eec934< ecf45080a4d3f4526cacb8b14060fe3b49a6913b affected
122ff243f5f104194750ecbc76d5946dd1eec934< a0ffc6081a8b27082dd5eae5aa1e3f59bbecf06c affected
122ff243f5f104194750ecbc76d5946dd1eec934< 5b23a2ff379e70b6b9ff744a972b63e1f8f4d996 affected
122ff243f5f104194750ecbc76d5946dd1eec934< 8e59d4d0dcde2dfb07a7ef855c849a2a0560aa57 affected
122ff243f5f104194750ecbc76d5946dd1eec934< 6512c57c4638ddec113bf42439361ba85a12048d affected
122ff243f5f104194750ecbc76d5946dd1eec934< a7f4eefb6e1458431eef9fa20fb363320d185f76 affected
122ff243f5f104194750ecbc76d5946dd1eec934< 155f90be5ee8be5b110ebc0b7da33c54c83b0208 affected
122ff243f5f104194750ecbc76d5946dd1eec934< 87a1e0fe7776da7ab411be332b4be58ac8840d10 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-64002

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() ipv4_sysctl_exit_net() is currently freeing net->ipv4.sysctl_local_reserved_ports too soon. Only after unregister_net_sysctl_table() we can be sure no threads can possibly use the sysctls, including /proc/sys/net/ipv4/ip_local_reserved_ports.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 3.16版本至7.0.12版本及之前的7.0.x版本存在安全漏洞，该漏洞源于在ipv4_sysctl_exit_net()中过早释放net->ipv4.sysctl_local_reserved_ports，可能导致被其他线程使用。以下版本受到影响：3.16版本、5.10.259版本及之前的5.10.x版本、5.15.210版本及之前的5.15.x版本、6.1.176版本及之前的6.1.x版本、6.6.143
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 122ff243f5f104194750ecbc76d5946dd1eec934 ~ ecf45080a4d3f4526cacb8b14060fe3b49a6913b -
Linux Linux 3.16 -

II. Public POCs for CVE-2026-64002

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64002

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-64002 (8)

Same Patch Batch · Linux · 2026-07-19 · 429 CVEs total

CVE-2026-63795 10.0 CRITICAL 9p: avoid putting oldfid in p9_client_walk() error path
CVE-2026-64068 9.8 CRITICAL netfs: Fix missing locking around retry adding new subreqs
CVE-2026-63993 9.8 CRITICAL vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
CVE-2026-64142 9.8 CRITICAL ksmbd: close durable scavenger races against m_fp_list lookups
CVE-2026-64033 9.8 CRITICAL RDMA/rtrs: Fix use-after-free in path file creation cleanup
CVE-2026-53399 9.8 CRITICAL nfsd: release layout stid on setlease failure
CVE-2026-53398 9.8 CRITICAL NFSD: Fix SECINFO_NO_NAME decode error cleanup
CVE-2026-64061 9.8 CRITICAL netfs: Fix early put of sink folio in netfs_read_gaps()
CVE-2026-64025 9.8 CRITICAL bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
CVE-2026-64089 9.8 CRITICAL batman-adv: tt: fix negative last_changeset_len
CVE-2026-64125 9.8 CRITICAL net: bcmgenet: keep RBUF EEE/PM disabled
CVE-2026-64091 9.8 CRITICAL batman-adv: tt: fix TOCTOU race for reported vlans
CVE-2026-64066 9.8 CRITICAL netfs: Fix netfs_read_to_pagecache() to pause on subreq failure
CVE-2026-63887 9.8 CRITICAL scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
CVE-2026-63808 9.8 CRITICAL exfat: fix potential use-after-free in exfat_find_dir_entry()
CVE-2026-63978 9.8 CRITICAL net/handshake: Drain pending requests at net namespace exit
CVE-2026-64132 9.8 CRITICAL ipv6: ioam: refresh hdr pointer before ioam6_event()
CVE-2026-63979 9.8 CRITICAL net/handshake: hand off the pinned file reference to accept_doit
CVE-2026-64136 9.8 CRITICAL smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()
CVE-2026-63800 9.8 CRITICAL pNFS: Fix use-after-free in pnfs_update_layout()

Showing top 20 of 429 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-64002

No comments yet

Leave a comment