In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skb_queue_len() readers on audit_queue Multiple readers… (CVE-2026-64435)
Source GCVE Database
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 25% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:HWhat to do
AI-suggested
A fix is available that replaces the vulnerable skb_queue_len() calls with skb_queue_len_lockless(), which uses atomic operations to prevent data races. Users should update to a Linux kernel version that includes this fix. Since this is a kernel-level fix, applying the official kernel update is the recommended remediation.
Description
A data race vulnerability in the Linux kernel's audit subsystem was resolved by replacing unsafe access to audit_queue length with a lockless helper that uses proper atomic operations. The flaw involved multiple readers accessing audit_queue.qlen without proper synchronization, while a writer updated it under a spinlock, leading to potential data races. This issue was reported by KCSAN and affects audit_queue length reads in several audit-related functions.
Impact
The data race can lead to inconsistent or incorrect audit queue length readings, potentially causing incorrect audit backlog handling or warnings. The CVSS score of 8.2 indicates high severity with impact on integrity and availability, but no confidentiality impact. There is no indication of known exploits in the wild.
Summary
The vulnerability (CVE-2026-64435) in the Linux kernel audit subsystem involves data races on the audit_queue length field (qlen). Multiple readers call skb_queue_len() on audit_queue without holding the queue lock or using READ_ONCE(), while the writer updates this field via skb_dequeue() → __skb_unlink() with WRITE_ONCE() protected by a spinlock. This mismatch causes data races, as confirmed by KCSAN reports showing conflicting read and write accesses. The race condition affects several call sites including kauditd_thread(), audit_receive_msg(), audit_receive(), and audit_log_start(). The fix replaces skb_queue_len() with skb_queue_len_lockless(), which uses READ_ONCE() internally, ensuring proper atomic access and eliminating the race.
Weaknesses
References
- nvd.nist.gov/vuln/detail/CVE-2026-64435 (opens in a new tab)
- git.kernel.org/stable/c/69f98fff30bdaa72b0cb0e7e078ab6456a0a59b0 (opens in a new tab)
- git.kernel.org/stable/c/7ff42312ccde549f8c698723822c7db35107a39b (opens in a new tab)
- git.kernel.org/stable/c/a3d85dec60bb0622360fc176b2a51abdbe2ff0ad (opens in a new tab)
- git.kernel.org/stable/c/b35597bdae1a5d8395da4b9baa993b9b71f74d68 (opens in a new tab)
- git.kernel.org/stable/c/c5186201fa7030289cc4fe23fae87a3fcb566856 (opens in a new tab)
- git.kernel.org/stable/c/c9a71daaecb2fb1d8c704545cc0b1c920b9bf5d7 (opens in a new tab)
- git.kernel.org/stable/c/e575dabb805252e3113fdc3f56f6ecacfde422d0 (opens in a new tab)
- git.kernel.org/stable/c/fe997a84a385f840b593ead92e575503a5046cee (opens in a new tab)