CVE-2026-64563

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the Linux kernel during rhashtable walks. The function rhashtable walk start check() contains two restart paths for resuming a walk; when iter->walker.tbl is NULL because the table was freed during a resize, the function fails to clear the iter->p variable. Subsequently, rhashtable walk next() dereferences the stale iter->p, leading to a read of freed memory. This affects any caller performing multi-fragment rhashtable walks across walk stop/walk start boundaries, specifically including netlink diag dump() in net/netlink/diag.c and tipc nl sk walk() in net/tipc/socket.c.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.