CVE-2026-64563: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64563 is a use-after-free vulnerability in the Linux kernel's rhashtable implementation, specifically in rhashtable_walk_start_check(). When a hash table is freed during a resize operation, the function resets slot and skip counters but fails to clear the stale iterator pointer iter->p, which is subsequently dereferenced by rhashtable_walk_next(), resulting in a read of freed kernel memory. The vulnerability affects Linux kernel versions from 4.18 up to (but not including) the patched commits, with fixes available in stable branches at 6.18.42, 7.1.6, and 7.2-rc5. A CVSS base score has not yet been formally assigned; Feedly estimates the severity as Medium (GitHub Advisory, Feedly).

The root cause is a use-after-free (CWE-416) in lib/rhashtable.c. The function rhashtable_walk_start_check() has two code paths for resuming a walk: when iter->walker.tbl is valid, it re-validates iter->p and nullifies it if the object is gone; however, when iter->walker.tbl is NULL (indicating the table was freed during a resize), it only resets slot and skip counters without clearing iter->p. Any subsequent call to rhashtable_walk_next() then dereferences this stale pointer into freed kernel memory. Callers performing multi-fragment rhashtable walks across walk_stop/walk_start boundaries are affected, with confirmed vulnerable code paths in netlink_diag (__netlink_diag_dump in net/netlink/diag.c) and TIPC (tipc_nl_sk_walk in net/tipc/socket.c). The KASAN crash report shows a read of 8 bytes at a freed kmalloc-2k slab object (GitHub Advisory).

Successful exploitation allows a local user to read freed kernel memory, resulting in information disclosure of sensitive kernel memory contents. The primary impact is on confidentiality — an attacker could potentially extract kernel pointers, credentials, or other sensitive data resident in freed slab memory. In addition to information disclosure, the use-after-free condition can cause kernel crashes (denial of service), as evidenced by the KASAN bug report in the crash stack trace (GitHub Advisory, Feedly).

1. Gain local access: Obtain a local user account on a vulnerable Linux system running kernel version 4.18 or later (prior to the patched versions).
2. Identify vulnerable subsystem: Confirm that netlink diagnostic (AF_NETLINK with NETLINK_SOCK_DIAG) or TIPC socket operations are available and accessible to the user.
3. Trigger a hash table resize: Initiate conditions that cause the kernel's rhashtable to resize (e.g., by creating a large number of netlink sockets or TIPC sockets to force a rehash).
4. Perform multi-fragment walk: Issue a netlink dump request (e.g., via recvfrom on a NETLINK_SOCK_DIAG socket) that spans multiple fragments, causing rhashtable_walk_stop and rhashtable_walk_start to be called across the resize boundary.
5. Trigger use-after-free read: When rhashtable_walk_start_check() resumes with iter->walker.tbl == NULL (table freed during resize), iter->p is not cleared; the subsequent rhashtable_walk_next() dereferences the stale pointer, reading freed kernel memory.
6. Extract data: Analyze the returned data or kernel crash output (e.g., via KASAN reports) to extract sensitive kernel memory contents such as pointers or credentials (GitHub Advisory).

• Logs: Kernel logs (dmesg) showing BUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365/0x3c0 with a call trace involving __netlink_diag_dump or tipc_nl_sk_walk.
• Logs: Kernel oops or panic messages referencing lib/rhashtable.c:1016 or net/netlink/diag.c:122.
• Process: Unusual or repeated recvfrom syscalls on NETLINK_SOCK_DIAG sockets from non-administrative processes.
• Process: Unexpected TIPC socket introspection activity from unprivileged user processes.
• Logs: KASAN reports indicating reads from freed kmalloc-2k slab objects at offsets consistent with rhashtable iterator structures (GitHub Advisory).

Update the Linux kernel to a version containing the fix: stable branch 6.18.42 or later, 7.1.6 or later, or 7.2-rc5 or later. The fix ensures that rhashtable_walk_start_check() clears iter->p when iter->walker.tbl is NULL, preventing the stale pointer dereference. As a temporary workaround where patching is not immediately possible, restrict unprivileged access to netlink diagnostic operations (e.g., via CAP_NET_ADMIN enforcement) and disable TIPC if not required. Three upstream fix commits are available: 3ff7c1dbf722, 4169d9fb92f3, and 8173f7e2ce67 (GitHub Advisory, Feedly).