In the Linux kernel, the following vulnerability has been resolved: phonet/pep: disable BH around forwarded sk_receive_skb() The networking receive… (CVE-2026-64177)

CVE-2026-64177 concerns the Linux kernel phonet/pep networking code where bottom halves (BH) were not properly disabled around forwarded sk_receive_skb() calls. The networking receive path normally runs in softirq context, but when packets are processed later in process context, the socket lock is dropped with spin_unlock_bh() and then sk_backlog_rcv() is called with BH enabled. The pep_do_rcv() handler forwards packets to child sockets using sk_receive_skb(), which assumes BH is disabled. This leads to the child socket lock being acquired inconsistently with BH enabled or disabled, causing potential kernel instability or crashes. The vulnerability was fixed by disabling BH around forwarded sk_receive_skb() calls. The fix is included in Linux kernel updates for Ubuntu 20.04 LTS and related releases. The CVSS 3.1 score is 5.5 (medium), reflecting local attack vector with low complexity and no confidentiality or integrity impact but high availability impact (denial of service).

The vulnerability can cause a denial of service by crashing the Linux kernel due to inconsistent locking states in the phonet/pep networking subsystem. There is no impact on confidentiality or integrity. Exploitation requires local access with low privileges. No known exploits in the wild have been reported.

A patch is available and included in updated Linux kernel packages for Ubuntu 20.04 LTS and related distributions. Users should apply the standard system update and reboot to ensure the fix is active. Due to an ABI change, third-party kernel modules must be recompiled and reinstalled after the update. No additional mitigation steps are required beyond applying the official updates.