CVE-2026-64005

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64005", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.026Z", "datePublished": "2026-07-19T14:56:21.608Z", "dateUpdated": "2026-10-19T20:18:02.958Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:38:05.933Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: Do not re-initialize smc hashtables\n\nINIT_HLIST_HEAD(&smc_v*_hashinfo.ht) are called after smc_nl_init(),\nproto_register() and sock_register(). This can lead to smc_v*_hashinfo.ht\nbeing reset even though hash entries already exist and are being used,\npossibly resulting in a corrupted list.\n\nRemove unnecessary and dangerous re-initialisation of smc_v*_hashinfo.ht in\nsmc_init(); it is implicitly initialised to zero anyhow. Add\nHLIST_HEAD_INIT to the definitions for clarity."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires winning a race during SMC module initialization by concurrently calling socket(PF_SMC)/socket(AF_INET, SOCK_STREAM, IPPROTO_SMC) syscalls. The bug is not reachable from remote network packet handling; SMC network upgrade paths operate only after initialization completes.\nAC:L - An attacker controls both sides of the race by spawning concurrent threads that hammer socket creation while another thread triggers SMC module autoload via request_module(\"net-pf-43\") during sock_register(). The vulnerable window between sock_register() and INIT_HLIST_HEAD() is narrow but attacker-driven and repeatable on each module load/reload.\nPR:L - Creating PF_SMC or IPPROTO_SMC sockets requires only an unprivileged local user account; no CAP_NET_ADMIN, CAP_SYS_MODULE, or real root in the initial namespace is needed to participate in the race when module autoload is enabled. Triggering module load may require admin action on hardened systems, but the corrupting socket operations themselves need only basic local privileges.\nUI:N - No victim interaction is required beyond the attacker's own concurrent socket creation during module initialization; no mount, file open, or other user action is needed.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security boundary; this is not a VM escape, IOMMU bypass, or cross-authority sandbox escape.\nC:H - Resetting smc_v4/v6_hashinfo.ht after sockets are hashed orphans live sk_node entries; subsequent hlist traversal in smc_diag_dump_proto() or corrupted pointer chasing can read arbitrary kernel memory adjacent to socket structures.\nI:H - Orphaned hlist nodes cause __hlist_del() in smc_unhash_sk() to write through stale pprev/next pointers when corrupted sockets are closed, enabling exploitable kernel heap/list corruption and potential control-flow hijacking.\nA:H - List corruption reliably causes kernel oops or panic when orphaned sockets are unhashed (__hlist_del with NULL next) or when the corrupted hashtable is walked, resulting in complete loss of kernel availability."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/smc/af_smc.c"], "versions": [{"version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "lessThan": "cdc79c05cc375f68ae87b0c74fdaac1a5c93155a", "status": "affected", "versionType": "git"}, {"version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "lessThan": "2006605006e5a4a11d93e1ebdbbe95764d24276f", "status": "affected", "versionType": "git"}, {"version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "lessThan": "64c96e497d5ada0b90e99bf58f893aa2b73dcfbc", "status": "affected", "versionType": "git"}, {"version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "lessThan": "ed7a758313011885347b854e97cb95903ef3c3f7", "status": "affected", "versionType": "git"}, {"version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "lessThan": "0cc9d0ac22d02f1ba1884de5d6de9eaf8b45d82d", "status": "affected", "versionType": "git"}, {"version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "lessThan": "55cba6b883b41e5922c00ba9d4e3262131f46f1b", "status": "affected", "versionType": "git"}, {"version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "lessThan": "5ec939367e700722ffbb1b7cacccbb1a3cf0ebd1", "status": "affected", "versionType": "git"}, {"version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "lessThan": "9e4389b0038781f19f97895186ed941ff8ac1678", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/smc/af_smc.c"], "versions": [{"version": "4.11", "status": "affected"}, {"version": "0", "lessThan": "4.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.259", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.93", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.10.259"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "5.15.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.1.176"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.6.143"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.12.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "6.18.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.11", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cdc79c05cc375f68ae87b0c74fdaac1a5c93155a"}, {"url": "https://git.kernel.org/stable/c/2006605006e5a4a11d93e1ebdbbe95764d24276f"}, {"url": "https://git.kernel.org/stable/c/64c96e497d5ada0b90e99bf58f893aa2b73dcfbc"}, {"url": "https://git.kernel.org/stable/c/ed7a758313011885347b854e97cb95903ef3c3f7"}, {"url": "https://git.kernel.org/stable/c/0cc9d0ac22d02f1ba1884de5d6de9eaf8b45d82d"}, {"url": "https://git.kernel.org/stable/c/55cba6b883b41e5922c00ba9d4e3262131f46f1b"}, {"url": "https://git.kernel.org/stable/c/5ec939367e700722ffbb1b7cacccbb1a3cf0ebd1"}, {"url": "https://git.kernel.org/stable/c/9e4389b0038781f19f97895186ed941ff8ac1678"}], "title": "net/smc: Do not re-initialize smc hashtables", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64005", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:35:10.431253Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-662", "description": "CWE-662 Improper Synchronization"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:18:02.958Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64005", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:35:10.431253Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-662", "description": "CWE-662 Improper Synchronization"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:35:11.005Z"}}], "cna": {"title": "net/smc: Do not re-initialize smc hashtables", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires winning a race during SMC module initialization by concurrently calling socket(PF_SMC)/socket(AF_INET, SOCK_STREAM, IPPROTO_SMC) syscalls. The bug is not reachable from remote network packet handling; SMC network upgrade paths operate only after initialization completes.\nAC:L - An attacker controls both sides of the race by spawning concurrent threads that hammer socket creation while another thread triggers SMC module autoload via request_module(\"net-pf-43\") during sock_register(). The vulnerable window between sock_register() and INIT_HLIST_HEAD() is narrow but attacker-driven and repeatable on each module load/reload.\nPR:L - Creating PF_SMC or IPPROTO_SMC sockets requires only an unprivileged local user account; no CAP_NET_ADMIN, CAP_SYS_MODULE, or real root in the initial namespace is needed to participate in the race when module autoload is enabled. Triggering module load may require admin action on hardened systems, but the corrupting socket operations themselves need only basic local privileges.\nUI:N - No victim interaction is required beyond the attacker's own concurrent socket creation during module initialization; no mount, file open, or other user action is needed.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security boundary; this is not a VM escape, IOMMU bypass, or cross-authority sandbox escape.\nC:H - Resetting smc_v4/v6_hashinfo.ht after sockets are hashed orphans live sk_node entries; subsequent hlist traversal in smc_diag_dump_proto() or corrupted pointer chasing can read arbitrary kernel memory adjacent to socket structures.\nI:H - Orphaned hlist nodes cause __hlist_del() in smc_unhash_sk() to write through stale pprev/next pointers when corrupted sockets are closed, enabling exploitable kernel heap/list corruption and potential control-flow hijacking.\nA:H - List corruption reliably causes kernel oops or panic when orphaned sockets are unhashed (__hlist_del with NULL next) or when the corrupted hashtable is walked, resulting in complete loss of kernel availability."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "lessThan": "cdc79c05cc375f68ae87b0c74fdaac1a5c93155a", "versionType": "git"}, {"status": "affected", "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "lessThan": "2006605006e5a4a11d93e1ebdbbe95764d24276f", "versionType": "git"}, {"status": "affected", "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "lessThan": "64c96e497d5ada0b90e99bf58f893aa2b73dcfbc", "versionType": "git"}, {"status": "affected", "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "lessThan": "ed7a758313011885347b854e97cb95903ef3c3f7", "versionType": "git"}, {"status": "affected", "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "lessThan": "0cc9d0ac22d02f1ba1884de5d6de9eaf8b45d82d", "versionType": "git"}, {"status": "affected", "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "lessThan": "55cba6b883b41e5922c00ba9d4e3262131f46f1b", "versionType": "git"}, {"status": "affected", "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "lessThan": "5ec939367e700722ffbb1b7cacccbb1a3cf0ebd1", "versionType": "git"}, {"status": "affected", "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "lessThan": "9e4389b0038781f19f97895186ed941ff8ac1678", "versionType": "git"}], "programFiles": ["net/smc/af_smc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.11"}, {"status": "unaffected", "version": "0", "lessThan": "4.11", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.259", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.210", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.176", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.143", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.93", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.35", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.12", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/smc/af_smc.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/cdc79c05cc375f68ae87b0c74fdaac1a5c93155a"}, {"url": "https://git.kernel.org/stable/c/2006605006e5a4a11d93e1ebdbbe95764d24276f"}, {"url": "https://git.kernel.org/stable/c/64c96e497d5ada0b90e99bf58f893aa2b73dcfbc"}, {"url": "https://git.kernel.org/stable/c/ed7a758313011885347b854e97cb95903ef3c3f7"}, {"url": "https://git.kernel.org/stable/c/0cc9d0ac22d02f1ba1884de5d6de9eaf8b45d82d"}, {"url": "https://git.kernel.org/stable/c/55cba6b883b41e5922c00ba9d4e3262131f46f1b"}, {"url": "https://git.kernel.org/stable/c/5ec939367e700722ffbb1b7cacccbb1a3cf0ebd1"}, {"url": "https://git.kernel.org/stable/c/9e4389b0038781f19f97895186ed941ff8ac1678"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: Do not re-initialize smc hashtables\n\nINIT_HLIST_HEAD(&smc_v*_hashinfo.ht) are called after smc_nl_init(),\nproto_register() and sock_register(). This can lead to smc_v*_hashinfo.ht\nbeing reset even though hash entries already exist and are being used,\npossibly resulting in a corrupted list.\n\nRemove unnecessary and dangerous re-initialisation of smc_v*_hashinfo.ht in\nsmc_init(); it is implicitly initialised to zero anyhow. Add\nHLIST_HEAD_INIT to the definitions for clarity."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.259", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.210", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.176", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.143", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.93", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.35", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.12", "versionStartIncluding": "4.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "4.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:38:05.933Z"}}}, "cveMetadata": {"cveId": "CVE-2026-64005", "state": "PUBLISHED", "dateUpdated": "2026-10-19T20:18:02.958Z", "dateReserved": "2026-07-19T07:54:57.026Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-19T14:56:21.608Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/smc/af_smc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cdc79c05cc375f68ae87b0c74fdaac1a5c93155a", "status": "affected", "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "versionType": "git"}, {"lessThan": "2006605006e5a4a11d93e1ebdbbe95764d24276f", "status": "affected", "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "versionType": "git"}, {"lessThan": "64c96e497d5ada0b90e99bf58f893aa2b73dcfbc", "status": "affected", "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "versionType": "git"}, {"lessThan": "ed7a758313011885347b854e97cb95903ef3c3f7", "status": "affected", "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "versionType": "git"}, {"lessThan": "0cc9d0ac22d02f1ba1884de5d6de9eaf8b45d82d", "status": "affected", "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "versionType": "git"}, {"lessThan": "55cba6b883b41e5922c00ba9d4e3262131f46f1b", "status": "affected", "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "versionType": "git"}, {"lessThan": "5ec939367e700722ffbb1b7cacccbb1a3cf0ebd1", "status": "affected", "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "versionType": "git"}, {"lessThan": "9e4389b0038781f19f97895186ed941ff8ac1678", "status": "affected", "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/smc/af_smc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.11"}, {"lessThan": "4.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.259", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.210", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.176", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.143", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.93", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.35", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "30ACBC0B-8A34-4264-9F71-F241CA7BA0FC", "versionEndExcluding": "5.10.259", "versionStartIncluding": "4.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801", "versionEndExcluding": "5.15.210", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757", "versionEndExcluding": "6.1.176", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C", "versionEndExcluding": "6.6.143", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1E73413E-0629-41AA-A4D3-5A3D10A0BD63", "versionEndExcluding": "6.12.93", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0FCCB23A-7629-4386-93B6-B119237C4382", "versionEndExcluding": "6.18.35", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9161A938-0FA8-44BC-95FE-C5A271601AB3", "versionEndExcluding": "7.0.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: Do not re-initialize smc hashtables\n\nINIT_HLIST_HEAD(&smc_v*_hashinfo.ht) are called after smc_nl_init(),\nproto_register() and sock_register(). This can lead to smc_v*_hashinfo.ht\nbeing reset even though hash entries already exist and are being used,\npossibly resulting in a corrupted list.\n\nRemove unnecessary and dangerous re-initialisation of smc_v*_hashinfo.ht in\nsmc_init(); it is implicitly initialised to zero anyhow. Add\nHLIST_HEAD_INIT to the definitions for clarity."}], "id": "CVE-2026-64005", "lastModified": "2026-10-19T21:17:18.560", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64005", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:35:10.431253Z", "version": "2.0.3"}}]}, "published": "2026-07-19T16:17:40.170", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0cc9d0ac22d02f1ba1884de5d6de9eaf8b45d82d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2006605006e5a4a11d93e1ebdbbe95764d24276f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/55cba6b883b41e5922c00ba9d4e3262131f46f1b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5ec939367e700722ffbb1b7cacccbb1a3cf0ebd1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/64c96e497d5ada0b90e99bf58f893aa2b73dcfbc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9e4389b0038781f19f97895186ed941ff8ac1678"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cdc79c05cc375f68ae87b0c74fdaac1a5c93155a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ed7a758313011885347b854e97cb95903ef3c3f7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-667"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-662"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: net/smc: Do not re-initialize smc hashtables", "id": "2502360", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502360"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-237", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/smc: Do not re-initialize smc hashtables\nINIT_HLIST_HEAD(&smc_v*_hashinfo.ht) are called after smc_nl_init(),\nproto_register() and sock_register(). This can lead to smc_v*_hashinfo.ht\nbeing reset even though hash entries already exist and are being used,\npossibly resulting in a corrupted list.\nRemove unnecessary and dangerous re-initialisation of smc_v*_hashinfo.ht in\nsmc_init(); it is implicitly initialised to zero anyhow. Add\nHLIST_HEAD_INIT to the definitions for clarity.", "A flaw was found in the Linux kernel's Server Message Block (SMC) network component. This vulnerability occurs because the system's internal tables, known as hashtables, are improperly reset after they have already been initialized and are actively in use. This incorrect re-initialization can lead to a corrupted list within the kernel. Such corruption could potentially cause system instability or other unpredictable behavior."], "name": "CVE-2026-64005", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64005\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64005\nhttps://lore.kernel.org/linux-cve-announce/2026071907-CVE-2026-64005-594b@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f16a7dd5cf27eeda187425c9c7d96802a549f9c4,cdc79c05cc375f68ae87b0c74fdaac1a5c93155a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f16a7dd5cf27eeda187425c9c7d96802a549f9c4,2006605006e5a4a11d93e1ebdbbe95764d24276f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f16a7dd5cf27eeda187425c9c7d96802a549f9c4,64c96e497d5ada0b90e99bf58f893aa2b73dcfbc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f16a7dd5cf27eeda187425c9c7d96802a549f9c4,5ec939367e700722ffbb1b7cacccbb1a3cf0ebd1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f16a7dd5cf27eeda187425c9c7d96802a549f9c4,0cc9d0ac22d02f1ba1884de5d6de9eaf8b45d82d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f16a7dd5cf27eeda187425c9c7d96802a549f9c4,55cba6b883b41e5922c00ba9d4e3262131f46f1b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f16a7dd5cf27eeda187425c9c7d96802a549f9c4,9e4389b0038781f19f97895186ed941ff8ac1678)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f16a7dd5cf27eeda187425c9c7d96802a549f9c4,5ec939367e700722ffbb1b7cacccbb1a3cf0ebd1)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.259,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.210,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.176,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.143,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.93,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.35,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.12,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T09:00:03.294903+00:00", "updated": "2026-10-20T09:15:12.775879+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}