CVE-2026-64563 in Linux
Summary
by MITRE • 08/04/2026
In the Linux kernel, the following vulnerability has been resolved:
rhashtable: clear stale iter->p on table restart
rhashtable_walk_start_check() has two restart paths when resuming a walk. When iter->walker.tbl is valid, it re-validates iter->p against the table and sets iter->p = NULL if the object is gone. When iter->walker.tbl is NULL (table was freed during resize), it resets slot and skip but forgets to clear iter->p.
rhashtable_walk_next() then dereferences the stale iter->p, reading freed memory. This is a use-after-free.
Any caller that does multi-fragment rhashtable walks across walk_stop/walk_start boundaries is affected. Concrete cases include netlink_diag (__netlink_diag_dump in net/netlink/diag.c) and TIPC (tipc_nl_sk_walk in net/tipc/socket.c).
Crash stack (netlink_diag): BUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365/0x3c0 Read of size 8 at addr ffff88801a9d2438 (freed kmalloc-2k, offset 1080) Call Trace: rhashtable_walk_next+0x365/0x3c0 (lib/rhashtable.c:1016) __netlink_diag_dump+0x160/0x760 (net/netlink/diag.c:122) netlink_diag_dump+0xc2/0x240 netlink_dump+0x5bc/0x1270 netlink_recvmsg+0x7a3/0x980 sock_recvmsg+0x1bc/0x200 __sys_recvfrom+0x1d4/0x2c0
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/04/2026
The vulnerability described represents a critical use-after-free condition in the Linux kernel's rhashtable implementation that stems from improper handling of iterator state during table restart operations. This flaw exists within the rhashtable_walk_start_check() function which manages the traversal of hash table entries across potential table modifications. The issue manifests when a hash table undergoes resizing or cleanup while an ongoing iteration is in progress, creating a scenario where stale iterator pointers remain unvalidated.
The technical root cause involves two distinct code paths within the rhashtable_walk_start_check() function that handle different states of the iterator's associated table reference. When iter->walker.tbl contains a valid table reference, the implementation correctly validates iter->p against the current table state and properly sets iter->p = NULL if the referenced object has been removed. However, when iter->walker.tbl is NULL indicating that the table was freed during a resize operation, the function fails to clear the stale iter->p pointer despite resetting other iterator state variables such as slot and skip. This inconsistent handling creates a dangerous state where iterator pointers reference memory that may have already been freed.
The operational impact of this vulnerability is severe as it allows for direct memory corruption through use-after-free conditions during hash table traversal operations. The rhashtable_walk_next() function subsequently dereferences the stale iter->p pointer without proper validation, leading to access of freed kernel memory regions. This condition can result in system crashes, data corruption, or potentially exploitable memory corruption that could be leveraged for privilege escalation attacks. The vulnerability specifically affects multi-fragment rhashtable walks that cross walk_stop/walk_start boundaries, which are common in network subsystem operations.
The affected systems include core network components such as netlink_diag and TIPC implementations where hash table iteration is prevalent. The crash stack trace from netlink_diag demonstrates the exact scenario where freed memory at address ffff88801a9d2438 is accessed, with a read operation of size 8 occurring on a kmalloc-2k allocation at offset 1080. This represents a classic use-after-free pattern that aligns with CWE-416, which specifically addresses use of freed memory conditions in software systems. The vulnerability's exploitation potential increases significantly when considering ATT&CK framework categories related to privilege escalation and system compromise through kernel-level memory corruption.
Mitigation strategies should focus on ensuring complete iterator state cleanup during table restart operations, specifically requiring that all stale pointer references be cleared regardless of the code path taken. Kernel patches must enforce consistent handling of iter->p across both validation scenarios within rhashtable_walk_start_check(), ensuring that no stale references persist after table modifications. Additionally, defensive programming practices should include explicit null-initialization of iterator pointers and comprehensive validation before memory dereference operations in all hash table traversal functions to prevent similar issues from arising in other kernel subsystems.