Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-64579— xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 5.0版本存在安全漏洞，该漏洞源于xfrm策略重建过程中对不精确bin的预分配逻辑错误，导致在内存压力下可能触发空指针或野指针解引用，造成内核崩溃。

AI Predicted 7.8 Difficulty: Moderate EPSS 0.17% · P6

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 24969facd704a5f0dd8e08da86bf32a9ce972bee< e48f4c3e3df35b34be719d72d737bbeaca77cf0c affected
24969facd704a5f0dd8e08da86bf32a9ce972bee< 1cdeed9df1306f1a277e715600772640d63defa9 affected
24969facd704a5f0dd8e08da86bf32a9ce972bee< 43a4d510523779891cf8eca7ffb4a086b0b5d8bf affected
24969facd704a5f0dd8e08da86bf32a9ce972bee< d9d9cc21cc90014724a14c447e3d587be9447107 affected
24969facd704a5f0dd8e08da86bf32a9ce972bee< 94c00391a5117530188334f740ce26d3f1256190 affected
24969facd704a5f0dd8e08da86bf32a9ce972bee< 7acc5ed2f33608a3d83b64f50a5766843b6e2485 affected
24969facd704a5f0dd8e08da86bf32a9ce972bee< 6aa3796d18a9fda953ad76a62b57bf6c145cb9ef affected
24969facd704a5f0dd8e08da86bf32a9ce972bee< f38f8cce2f7e79775b3db7e8a5eacda04ac908e4 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-64579

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert xfrm_hash_rebuild()'s first loop preallocates the bins/chains the reinsert loop needs, so the reinsert (after hlist_del_rcu()) cannot allocate or fail. But its guard is inverted: it skips policies with prefixlen < threshold and preallocates for the rest. prefixlen < threshold is exactly when policy_hash_bysel() returns NULL and the reinsert takes the allocating xfrm_policy_inexact_insert() path. So the loop preallocates for the exact policies (which never allocate) and skips the inexact ones, whose bin/node is then allocated GFP_ATOMIC during reinsert. On failure the error path only WARN_ONCE()s and continues, leaving a poisoned bydst node; the next rebuild's hlist_del_rcu() dereferences LIST_POISON2 and takes a GPF. Reachable under memory pressure, deterministic via failslab. Invert the guard so preallocation covers exactly the reinserted policies; the reinsert then allocates nothing and cannot fail. Crash: Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0xdead...] ... Workqueue: events xfrm_hash_rebuild RIP: 0010:xfrm_hash_rebuild+0x5b3/0x1190 RAX: dead000000000122 (LIST_POISON2 + offset) ... Call Trace: hlist_del_rcu (include/linux/rculist.h:599) xfrm_hash_rebuild (net/xfrm/xfrm_policy.c:1365) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) ... Kernel panic - not syncing: Fatal exception in interrupt
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 5.0版本存在安全漏洞，该漏洞源于xfrm策略重建过程中对不精确bin的预分配逻辑错误，导致在内存压力下可能触发空指针或野指针解引用，造成内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 24969facd704a5f0dd8e08da86bf32a9ce972bee ~ e48f4c3e3df35b34be719d72d737bbeaca77cf0c -
Linux Linux 5.0 -

II. Public POCs for CVE-2026-64579

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64579

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-64579 (8)

Same Patch Batch · Linux · 2026-08-05 · 17 CVEs total

CVE-2026-64566 9.8 CRITICAL xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()
CVE-2026-64578 8.2 HIGH ksmbd: validate compound request size before reading StructureSize2
CVE-2026-64567 7.8 HIGH btrfs: reject free space cache with more entries than pages
CVE-2026-64568 7.8 HIGH wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure
CVE-2026-64570 7.8 HIGH wifi: mac80211: fix fils_discovery double free on alloc failure
CVE-2026-64574 7.8 HIGH wifi: mac80211: tear down new links on vif update error path
CVE-2026-64575 7.8 HIGH bpf: tcp: fix double sock release on batch realloc
CVE-2026-64580 7.8 HIGH xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
CVE-2026-64581 7.8 HIGH xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
CVE-2026-64582 7.8 HIGH RDMA/rxe: Fix a use-after-free problem in rxe_mmap
CVE-2026-64577 7.5 HIGH gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
CVE-2026-64576 7.1 HIGH nexthop: initialize extack in nh_res_bucket_migrate()
CVE-2026-64569 mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
CVE-2026-64571 wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
CVE-2026-64572 ipv4: fib: free fib_alias with kfree_rcu() on insert error path
CVE-2026-64573 Bluetooth: qca: fix NVM tag length underflow in TLV parser

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-64579

No comments yet

Leave a comment