CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue
Published Jul 25, 2026
·Updated
audit: Fix data races of skbqueuelen() readers on auditqueue
Affected Software
11 affected componentsFixes available
Linux Kernel
Microsoft azl3 kernel 6.6.144.1-1<6.6.145.2-1
6.6.145.2-1
Linux Linux kernel>=4.10<5.10.261
Linux Linux kernel>=5.11<5.15.212
Linux Linux kernel>=5.16<6.1.178
Linux Linux kernel>=6.2<6.6.145
Linux Linux kernel>=6.7<6.12.96
Linux Linux kernel>=6.13<6.18.39
Linux Linux kernel>=6.19<7.1.4
Linux Linux kernel=7.2-rc1
Linux Linux kernel=7.2-rc2
Remediation
Event History
Jul 25, 2026
CVE Published
via MITRE·08:51 AM
Data Sourced
via MITRE·08:51 AM
DescriptionSeverity
Data Sourced
via NVD·10:17 AM
RemedyDescriptionSeverityWeaknessAffected Software
Jul 26, 2026
Data Sourced
via Microsoft·08:10 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·08:10 AM
DescriptionSeverity
Frequently Asked Questions
1
Which systems are exposed to this issue?
Systems running an affected Linux kernel with the audit subsystem in use are exposed. The issue concerns concurrent access to the audit queue length by audit-related kernel paths.
2
Does exploitation require local access, authentication, or user interaction?
No. The supplied CVSS vector indicates network reachability, low attack complexity, no privileges required, and no user interaction.
3
What is the expected impact?
The CVSS vector indicates high availability impact and low integrity impact, with no confidentiality impact. The underlying flaw is a race condition involving audit_queue.qlen accesses.
4
What should be done if patching cannot happen immediately?
The provided data identifies a patch as available, but does not provide a documented workaround or mitigation. Prioritize applying the available kernel patch.