CVE-2026-64435High· 8.2▾ TwilightIn the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skb_queue_len() readers on audit_queue Multiple readers access audit_queue.qlen via skb_queue_len() without holding the queue lock or using RE…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Last analysed / modified upstream
In the Linux kernel, the following vulnerability has been resolved:
audit: Fix data races of skb_queue_len() readers on audit_queue
Multiple readers access audit_queue.qlen via skb_queue_len() without holding the queue lock or using READ_ONCE(), while kauditd writes to this field via the skb_dequeue() → __skb_unlink() path with WRITE_ONCE() protected by a spinlock. This constitutes data races.
All affected skb_queue_len(&audit_queue) call sites:
BUG: KCSAN: data-race in audit_log_start / skb_dequeue
write (marked) to 0xffffffff8512ee20 of 4 bytes by task 661 on cpu 57: skb_dequeue+0x70/0xf0 kauditd_send_queue+0x71/0x220 kauditd_thread+0x1cb/0x430 kthread+0x1c2/0x210 ret_from_fork+0x162/0x1a0 ret_from_fork_asm+0x1a/0x30
read to 0xffffffff8512ee20 of 4 bytes by task 36586 on cpu 1: audit_log_start+0x2a0/0x6b0 audit_core_dumps+0x64/0xa0 do_coredump+0x14b/0x1260 get_signal+0xeb2/0xf70 arch_do_signal_or_restart+0x41/0x170 exit_to_user_mode_loop+0xa2/0x1c0 do_syscall_64+0x1a3/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0xe0
Resolve the race by switching to lockless helper skb_queue_len_lockless(), which internally uses READ_ONCE() and properly pairs with the WRITE_ONCE() write accesses already present on the writer side.
[PM: line length tweak]
Linux >= 3197542482df22c2a131d4a813280bd7c54cedf5 < 69f98fff30bdaa72b0cb0e7e078ab6456a0a59b0Linux >= 3197542482df22c2a131d4a813280bd7c54cedf5 < b35597bdae1a5d8395da4b9baa993b9b71f74d68Linux >= 3197542482df22c2a131d4a813280bd7c54cedf5 < e575dabb805252e3113fdc3f56f6ecacfde422d0Linux >= 3197542482df22c2a131d4a813280bd7c54cedf5 < 7ff42312ccde549f8c698723822c7db35107a39bLinux >= 3197542482df22c2a131d4a813280bd7c54cedf5 < a3d85dec60bb0622360fc176b2a51abdbe2ff0adLinux >= 3197542482df22c2a131d4a813280bd7c54cedf5 < fe997a84a385f840b593ead92e575503a5046ceeLinux >= 3197542482df22c2a131d4a813280bd7c54cedf5 < c5186201fa7030289cc4fe23fae87a3fcb566856Linux >= 3197542482df22c2a131d4a813280bd7c54cedf5 < c9a71daaecb2fb1d8c704545cc0b1c920b9bf5d7Linux 4.10Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99118Nonedrm/i915/dmc: Harden DMC firmware payload parsing
CVE-2026-99117Nonenet: bridge: mcast: don't truncate the port group walk on teardown
CVE-2026-99121Noneipv4: avoid divide by zero in fib_rebalance
CVE-2026-99120NoneKVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
CVE-2026-99119Nonedrm/amdgpu/userq: actually validate userq BOs
CVE-2026-99123Nonevsock/virtio: validate packet source for connected sockets