LiveActive security incident?Get immediate response
CVE Record

CVE-2026-64075: fprobe: Fix unregister_fprobe() to wait for RCU grace period

In the Linux kernel, the following vulnerability has been resolved: fprobe: Fix unregister_fprobe() to wait for RCU grace period Commit 4346ba1604093 ("fprobe: Rewrite fprobe on function-graph tracer") changed fprobe to register struct fprobe to an rcu-hlist, but it forgot to wait for RCU GP. Thus there can be use-after-free if the fprobe is released right after unregistering. This can be happened on fprobe event and sample module code. To fix this issue, add synchronize_rcu() in unregister_fprobe(). Note that BPF is OK because fprobe is used as a part of bpf_kprobe_multi_link. This unregisters its fprobe in bpf_kprobe_multi_link_release() and it is deallocated via bpf_kprobe_multi_link_dealloc(), which is invoked from bpf_link_defer_dealloc_rcu_gp() RCU callback. For BPF, this also introduced unregister_fprobe_async() which does NOT wait for RCU grace priod.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2026-64075 is a Linux kernel memory-safety flaw in fprobe cleanup. If an fprobe object is freed immediately after unregistering, another CPU may still reference it through RCU, causing use-after-free. The source bundle does not provide CVSS, impact details, or exploitation evidence.

Executive priority

Track this for kernel patch management, not emergency response, unless your environment uses fprobe-heavy tracing or custom kernel modules. Severity and exploitability are not established in the supplied evidence, but kernel use-after-free issues can become higher priority when vendors publish impact details.

Technical view

The bug stems from fprobe registration moving to an RCU hlist without unregister_fprobe() waiting for an RCU grace period. The resolved fix adds synchronize_rcu(). The source notes possible use-after-free in fprobe event and sample module code, while BPF’s kprobe multi-link path is described as already RCU-deferred.

Likely exposure

Exposure appears limited to Linux kernels containing the affected fprobe rewrite and using fprobe event or sample module paths. The supplied affected version data is inconsistent, so teams should validate against vendor kernel advisories and the referenced upstream stable commits.

Exploitation context

No active exploitation is stated. The CVE is not marked KEV in the supplied bundle, and no public exploit details are included. Treat this as a kernel memory-safety issue with unclear practical exploitability until vendor advisories add severity and affected-version guidance.

Researcher notes

Focus review on fprobe unregister lifetime handling after commit 4346ba1604093. The documented fix is synchronize_rcu() in unregister_fprobe(), with unregister_fprobe_async() added for BPF because BPF deallocation already waits through an RCU callback.

Mitigation direction

  • Apply vendor kernel updates containing the referenced stable fixes.
  • Prioritize systems using fprobe events, tracing, or sample module code.
  • Check Linux distribution advisories for exact affected and fixed package versions.
  • Avoid inventing workarounds; follow vendor kernel guidance if patches are unavailable.

Validation and detection

  • Confirm running kernels include a vendor backport of the fprobe RCU fix.
  • Map fleet kernel versions against distribution advisories for CVE-2026-64075.
  • Identify systems using fprobe event functionality or related sample modules.
  • Verify vulnerability scanners recognize patched vendor kernel builds correctly.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-64075 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4346ba1604093305a287e08eb465a9c15ba05b80, 4346ba1604093305a287e08eb465a9c15ba05b80, 4346ba1604093305a287e08eb465a9c15ba05b80unaffected
LinuxLinux6.14, 0, 6.18.34, 7.0.11, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.