CVE-2026-64002

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-64002

Import Source

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-64002

Downstream

Published

2026-07-19T14:56:19.495Z

Modified

2026-07-21T03:47:46.761790856Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

Details

In the Linux kernel, the following vulnerability has been resolved:

ipv4: free net->ipv4.sysctllocalreservedports after unregisternetsysctltable()

ipv4sysctlexitnet() is currently freeing net->ipv4.sysctllocalreservedports too soon.

Only after unregisternetsysctltable() we can be sure no threads can possibly use the sysctls, including /proc/sys/net/ipv4/iplocalreservedports.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64002.json",
    "cna_assigner": "Linux"
}

References

Affected packages

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

122ff243f5f104194750ecbc76d5946dd1eec934

Fixed

ecf45080a4d3f4526cacb8b14060fe3b49a6913b

Fixed

a0ffc6081a8b27082dd5eae5aa1e3f59bbecf06c

Fixed

5b23a2ff379e70b6b9ff744a972b63e1f8f4d996

Fixed

8e59d4d0dcde2dfb07a7ef855c849a2a0560aa57

Fixed

6512c57c4638ddec113bf42439361ba85a12048d

Fixed

a7f4eefb6e1458431eef9fa20fb363320d185f76

Fixed

155f90be5ee8be5b110ebc0b7da33c54c83b0208

Fixed

87a1e0fe7776da7ab411be332b4be58ac8840d10

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64002.json"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64002.json"