{"id":"CVE-2026-64435","state":"PUBLISHED","title":"audit: Fix data races of skb_queue_len() readers on audit_queue","description":"In the Linux kernel, the following vulnerability has been resolved:\n\naudit: Fix data races of skb_queue_len() readers on audit_queue\n\nMultiple readers access audit_queue.qlen via skb_queue_len() without\nholding the queue lock or using READ_ONCE(), while kauditd writes to\nthis field via the skb_dequeue() → __skb_unlink() path with WRITE_ONCE()\nprotected by a spinlock. This constitutes data races.\n\nAll affected skb_queue_len(&audit_queue) call sites:\n  - kauditd_thread() wait_event_freezable() condition\n  - audit_receive_msg() AUDIT_GET handler (s.backlog assignment)\n  - audit_receive() backlog check\n  - audit_log_start() backlog check and pr_warn()\n\nKCSAN reports the following conflicting access pattern (one example):\n==================================================================\nBUG: KCSAN: data-race in audit_log_start / skb_dequeue\n\nwrite (marked) to 0xffffffff8512ee20 of 4 bytes by task 661 on cpu 57:\n skb_dequeue+0x70/0xf0\n kauditd_send_queue+0x71/0x220\n kauditd_thread+0x1cb/0x430\n kthread+0x1c2/0x210\n ret_from_fork+0x162/0x1a0\n ret_from_fork_asm+0x1a/0x30\n\nread to 0xffffffff8512ee20 of 4 bytes by task 36586 on cpu 1:\n audit_log_start+0x2a0/0x6b0\n audit_core_dumps+0x64/0xa0\n do_coredump+0x14b/0x1260\n get_signal+0xeb2/0xf70\n arch_do_signal_or_restart+0x41/0x170\n exit_to_user_mode_loop+0xa2/0x1c0\n do_syscall_64+0x1a3/0x1c0\n entry_SYSCALL_64_after_hwframe+0x76/0xe0\n\nvalue changed: 0x00000001 -> 0x00000000\n==================================================================\n\nResolve the race by switching to lockless helper skb_queue_len_lockless(),\nwhich internally uses READ_ONCE() and properly pairs with the WRITE_ONCE()\nwrite accesses already present on the writer side.\n\n[PM: line length tweak]","publishedAt":"2026-07-25T08:51:09.688Z","updatedAt":"2026-10-19T20:38:28.743Z","severity":{"score":8.2,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","status":"affected","lessThan":"69f98fff30bdaa72b0cb0e7e078ab6456a0a59b0","versionType":"git"},{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","status":"affected","lessThan":"b35597bdae1a5d8395da4b9baa993b9b71f74d68","versionType":"git"},{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","status":"affected","lessThan":"e575dabb805252e3113fdc3f56f6ecacfde422d0","versionType":"git"},{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","status":"affected","lessThan":"7ff42312ccde549f8c698723822c7db35107a39b","versionType":"git"},{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","status":"affected","lessThan":"a3d85dec60bb0622360fc176b2a51abdbe2ff0ad","versionType":"git"},{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","status":"affected","lessThan":"fe997a84a385f840b593ead92e575503a5046cee","versionType":"git"},{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","status":"affected","lessThan":"c5186201fa7030289cc4fe23fae87a3fcb566856","versionType":"git"},{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","status":"affected","lessThan":"c9a71daaecb2fb1d8c704545cc0b1c920b9bf5d7","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/audit.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.10","versionType":"semver"},{"version":"5.10.261","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.212","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.96","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.39","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.4","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/audit.c"]}],"references":["https://git.kernel.org/stable/c/69f98fff30bdaa72b0cb0e7e078ab6456a0a59b0","https://git.kernel.org/stable/c/b35597bdae1a5d8395da4b9baa993b9b71f74d68","https://git.kernel.org/stable/c/e575dabb805252e3113fdc3f56f6ecacfde422d0","https://git.kernel.org/stable/c/7ff42312ccde549f8c698723822c7db35107a39b","https://git.kernel.org/stable/c/a3d85dec60bb0622360fc176b2a51abdbe2ff0ad","https://git.kernel.org/stable/c/fe997a84a385f840b593ead92e575503a5046cee","https://git.kernel.org/stable/c/c5186201fa7030289cc4fe23fae87a3fcb566856","https://git.kernel.org/stable/c/c9a71daaecb2fb1d8c704545cc0b1c920b9bf5d7"],"weaknesses":["CWE-362"],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/64xxx/CVE-2026-64435.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64435","state":"PUBLISHED","datePublished":"2026-07-25T08:51:09.688Z","dateUpdated":"2026-10-19T20:38:28.743Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-19T15:36:31.787Z"},"containers":{"cna":{"title":"audit: Fix data races of skb_queue_len() readers on audit_queue","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naudit: Fix data races of skb_queue_len() readers on audit_queue\n\nMultiple readers access audit_queue.qlen via skb_queue_len() without\nholding the queue lock or using READ_ONCE(), while kauditd writes to\nthis field via the skb_dequeue() → __skb_unlink() path with WRITE_ONCE()\nprotected by a spinlock. This constitutes data races.\n\nAll affected skb_queue_len(&audit_queue) call sites:\n  - kauditd_thread() wait_event_freezable() condition\n  - audit_receive_msg() AUDIT_GET handler (s.backlog assignment)\n  - audit_receive() backlog check\n  - audit_log_start() backlog check and pr_warn()\n\nKCSAN reports the following conflicting access pattern (one example):\n==================================================================\nBUG: KCSAN: data-race in audit_log_start / skb_dequeue\n\nwrite (marked) to 0xffffffff8512ee20 of 4 bytes by task 661 on cpu 57:\n skb_dequeue+0x70/0xf0\n kauditd_send_queue+0x71/0x220\n kauditd_thread+0x1cb/0x430\n kthread+0x1c2/0x210\n ret_from_fork+0x162/0x1a0\n ret_from_fork_asm+0x1a/0x30\n\nread to 0xffffffff8512ee20 of 4 bytes by task 36586 on cpu 1:\n audit_log_start+0x2a0/0x6b0\n audit_core_dumps+0x64/0xa0\n do_coredump+0x14b/0x1260\n get_signal+0xeb2/0xf70\n arch_do_signal_or_restart+0x41/0x170\n exit_to_user_mode_loop+0xa2/0x1c0\n do_syscall_64+0x1a3/0x1c0\n entry_SYSCALL_64_after_hwframe+0x76/0xe0\n\nvalue changed: 0x00000001 -> 0x00000000\n==================================================================\n\nResolve the race by switching to lockless helper skb_queue_len_lockless(),\nwhich internally uses READ_ONCE() and properly pairs with the WRITE_ONCE()\nwrite accesses already present on the writer side.\n\n[PM: line length tweak]"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","status":"affected","lessThan":"69f98fff30bdaa72b0cb0e7e078ab6456a0a59b0","versionType":"git"},{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","status":"affected","lessThan":"b35597bdae1a5d8395da4b9baa993b9b71f74d68","versionType":"git"},{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","status":"affected","lessThan":"e575dabb805252e3113fdc3f56f6ecacfde422d0","versionType":"git"},{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","status":"affected","lessThan":"7ff42312ccde549f8c698723822c7db35107a39b","versionType":"git"},{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","status":"affected","lessThan":"a3d85dec60bb0622360fc176b2a51abdbe2ff0ad","versionType":"git"},{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","status":"affected","lessThan":"fe997a84a385f840b593ead92e575503a5046cee","versionType":"git"},{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","status":"affected","lessThan":"c5186201fa7030289cc4fe23fae87a3fcb566856","versionType":"git"},{"version":"3197542482df22c2a131d4a813280bd7c54cedf5","status":"affected","lessThan":"c9a71daaecb2fb1d8c704545cc0b1c920b9bf5d7","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/audit.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.10","versionType":"semver"},{"version":"5.10.261","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.212","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.96","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.39","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.4","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/audit.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/69f98fff30bdaa72b0cb0e7e078ab6456a0a59b0"},{"url":"https://git.kernel.org/stable/c/b35597bdae1a5d8395da4b9baa993b9b71f74d68"},{"url":"https://git.kernel.org/stable/c/e575dabb805252e3113fdc3f56f6ecacfde422d0"},{"url":"https://git.kernel.org/stable/c/7ff42312ccde549f8c698723822c7db35107a39b"},{"url":"https://git.kernel.org/stable/c/a3d85dec60bb0622360fc176b2a51abdbe2ff0ad"},{"url":"https://git.kernel.org/stable/c/fe997a84a385f840b593ead92e575503a5046cee"},{"url":"https://git.kernel.org/stable/c/c5186201fa7030289cc4fe23fae87a3fcb566856"},{"url":"https://git.kernel.org/stable/c/c9a71daaecb2fb1d8c704545cc0b1c920b9bf5d7"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":8.2,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - Unauthenticated packets matching a pre-existing nftables audit-level logging or xtables AUDIT rule reach audit_log_start() through the network receive and netfilter paths.\nAC:L - Parallel matching traffic invokes the vulnerable readers while feeding and waking kauditd, allowing the attacker to repeatedly drive both sides of the race.\nPR:N - The audit rule must already be configured, but the remote attacker needs no credentials or capabilities to send matching packets.\nUI:N - No victim action is required after the affected network-audit configuration is active.\nS:U - The race and its effects remain within the host kernel and its audit security authority.\nC:N - The raced value is only the 32-bit queue length; no pointer, packet contents, or adjacent memory is disclosed.\nI:L - An incorrect backlog decision can delay or discard audit records, causing limited corruption of the security audit trail without an arbitrary-write primitive.\nA:H - In hardened systems using AUDIT_FAIL_PANIC, a raced queue length interpreted as exceeding the limit from the GFP_ATOMIC packet-audit path calls audit_log_lost() and can panic the kernel."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T04:55:36.444Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"5.10.261"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"5.15.212"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.1.178"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.12.96"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.18.39"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"7.1.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-64435","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-16T15:40:38.595570Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-362","lang":"en","type":"CWE","description":"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T20:38:28.743Z"}}]}}}