CVE-2026-64015 (CVSS 7.8)

Description

In the Linux kernel, the following vulnerability has been resolved: security/keys: fix missed RCU read section on lookup Nicholas Carlini reports that the keyring code calls assoc_array_find() in find_key_to_update() without holding the RCU read lock, while the assoc_array_gc() code really is designed around removing the node from the tree and then freeing it after an RCU grace-period. The regular key handling doesn't see this because holding the keyring semaphore hides any lifetime issues, but the persistent key handling uses a different model. Instead of extending the keyring locking, just do the simple RCU locking that the assoc_array was designed for.

Is your site exposed to CVE-2026-64015?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0013

Probability of exploitation

0.03%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/43a1e3744548e6fd85873e6fb43e293eb4010694 https://git.kernel.org/stable/c/4c5d407ba3ff7f30561ff73ba1b07ed70c864edc https://git.kernel.org/stable/c/50bb3435a5e627bfbdc52eb4536f49f88b3486b8 https://git.kernel.org/stable/c/5659e6923cb72f8e18e8b539109ab512455fe195 https://git.kernel.org/stable/c/66288dcadf80974436250e9f70ed848836b835b5 https://git.kernel.org/stable/c/cefa4265b11176c897a7d9e8e54d89e3701c5584

Frequently Asked Questions

What is CVE-2026-64015? +

In the Linux kernel, the following vulnerability has been resolved: security/keys: fix missed RCU read section on lookup Nicholas Carlini reports that the keyring code calls assoc_array_find() in find_key_to_update() without holding the RCU read lock, while the assoc_array_gc() code really is designed around removing the node from the tree and then freeing it after an RCU grace-period. The regular key handling doesn't see this because holding the keyring semaphore hides any lifetime issues, but the persistent key handling uses a different model. Instead of extending the keyring locking, just do the simple RCU locking that the assoc_array was designed for. It has a CVSS v3.1 base score of 7.8 (HIGH).

How severe is CVE-2026-64015? +

CVE-2026-64015 has a CVSS v3.1 score of 7.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0013, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-64015? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-64015