CVE-2026-64579: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64579 is a logic error in the Linux kernel's xfrm (IPsec) subsystem that can cause a kernel crash (denial of service) via a general protection fault during hash table rebuild operations. The vulnerability was published on August 5, 2026, and affects Linux kernel versions from 5.0 up to the fixed stable releases. Fixed versions include 5.10.265, 5.15.216, 6.1.183, 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2+. It carries a CVSS v3.1 base score of 4.1 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an inverted preallocation guard in xfrm_hash_rebuild() (CWE-825: Expired Pointer Dereference). The function's first loop is intended to preallocate hash bins for policies that will need allocation during reinsert, but the guard condition is backwards: it preallocates for exact-match policies (which never need allocation) and skips inexact policies (prefixlen < threshold), which do require allocation via xfrm_policy_inexact_insert(). During reinsert, inexact policies attempt a GFP_ATOMIC allocation; under memory pressure this fails, the error path only issues a WARN_ONCE() and continues, leaving a poisoned bydst node with LIST_POISON2. On the next xfrm_hash_rebuild() invocation, hlist_del_rcu() dereferences the poisoned pointer, triggering a general protection fault and kernel panic. The crash is deterministic when triggered via failslab (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation results in a kernel panic (general protection fault), causing a complete system denial of service. The vulnerability has no confidentiality or integrity impact — only availability is affected. Because the crash occurs in a kernel workqueue context (events xfrm_hash_rebuild), it brings down the entire system rather than just a single process, making recovery require a reboot (GitHub Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability requires local access with elevated privileges (PR:H) and high attack complexity (AC:H), specifically requiring memory pressure conditions to trigger the GFP_ATOMIC allocation failure. The EPSS score is approximately 0.156%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. It is detectable via Nessus plugin 332748 (GitHub Advisory, Red Hat Bugzilla).

1. Precondition: Obtain local access to a system running a vulnerable Linux kernel (5.0 through versions prior to the fixed stable releases) with IPsec/xfrm policies configured, including inexact (prefix-based) policies.
2. Induce memory pressure: Use a mechanism such as failslab (kernel fault injection) or exhaust system memory to cause GFP_ATOMIC allocations to fail in the kernel.
3. Trigger hash rebuild: Cause the xfrm policy hash to be rebuilt — this can occur when network interface parameters change or xfrm thresholds are modified, scheduling the xfrm_hash_rebuild workqueue event.
4. Poison the hash table: Under memory pressure, the xfrm_policy_inexact_insert() call for inexact policies fails; the error path issues WARN_ONCE() and leaves a LIST_POISON2-valued bydst node in the hash table.
5. Trigger kernel panic: Cause a second hash rebuild event; hlist_del_rcu() dereferences the poisoned LIST_POISON2 pointer, resulting in a general protection fault and kernel panic (GitHub Advisory, Red Hat Bugzilla).

• Logs: Kernel log (dmesg//var/log/kern.log) entries containing WARN_ONCE from the xfrm subsystem, particularly around xfrm_policy_inexact_insert failures under memory pressure.
• Logs: Kernel oops/panic messages referencing xfrm_hash_rebuild+0x5b3/0x1190, hlist_del_rcu, and RAX: dead000000000122 (LIST_POISON2 + offset).
• Logs: KASAN reports indicating wild-memory-access in range [0xdead...] or general protection fault for non-canonical address 0xfbd59c0000000024.
• Logs: Kernel panic message Fatal exception in interrupt following a workqueue event from events xfrm_hash_rebuild.
• Process/System: Unexpected system reboots or kernel panics on systems with IPsec/xfrm policies configured, especially under memory pressure conditions (GitHub Advisory).

Apply the upstream kernel fix that inverts the preallocation guard in xfrm_hash_rebuild() so that inexact policies are preallocated before reinsert, eliminating the possibility of GFP_ATOMIC allocation failure during the reinsert phase. Fixed stable kernel versions are: 5.10.265, 5.15.216, 6.1.183, 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2+. Distribution-specific updates are available from Red Hat and others. As a temporary workaround where patching is not immediately possible, avoid configuring inexact (prefix-based) xfrm/IPsec policies, or ensure systems are not subjected to extreme memory pressure conditions (GitHub Advisory, Red Hat Bugzilla).

Red Hat tracked the issue via Bugzilla (Bug 2511404) and issued a security advisory, rating it medium severity. The upstream kernel fix was referenced in the linux-cve-announce mailing list. Community coverage appeared on WindowsForum.com highlighting the IPsec xfrm flaw's ability to crash kernels, and the Yocto Project security list also flagged the issue for embedded Linux users (Red Hat Bugzilla).