CVE-2026-64109 (GCVE-0-2026-64109)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:40 – Updated: 2026-07-20 13:43
VLAI
Title
af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
Summary
In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() unix_stream_data_wait() does skb_peek_tail(&sk->sk_receive_queue) without holding any lock that prevents SKBs on that queue from being dequeued and freed. This has been the case since commit 79f632c71bea ("unix/stream: fix peeking with an offset larger than data in queue"). The first consequence of this is that the pointer comparison `tail != last` can be false even if `last` semantically refers to an already-freed SKB while `tail` is a new SKB allocated at the same address; which can cause unix_stream_data_wait() to wrongly keep blocking after new data has arrived, but only in a weird scenario where a peeking recv() and a normal recv() on the same socket are racing, which is probably not a real problem. But since commit 2b514574f7e8 ("net: af_unix: implement splice for stream af_unix sockets"), `tail` is actually dereferenced, which can cause UAF in the following race scenario (where test_setup() runs single-threaded, and afterwards, test_thread1() and test_thread2() run concurrently in two threads: ``` static int socks[2]; void test_setup(void) { socketpair(AF_UNIX, SOCK_STREAM, 0, socks); send(socks[1], "A", 1, 0); int peekoff = 1; setsockopt(socks[0], SOL_SOCKET, SO_PEEK_OFF, &peekoff, sizeof(peekoff)); } void test_thread1(void) { char dummy; recv(socks[0], &dummy, 1, MSG_PEEK); } void test_thread2(void) { char dummy; recv(socks[0], &dummy, 1, 0); shutdown(socks[1], SHUT_WR); } ``` when racing like this: ``` thread1 thread2 unix_stream_read_generic mutex_lock(&u->iolock) skb_peek(&sk->sk_receive_queue) skb_peek_next(skb, &sk->sk_receive_queue) mutex_unlock(&u->iolock) unix_stream_read_generic unix_state_lock(sk) skb_peek(&sk->sk_receive_queue) unix_state_unlock(sk) unix_stream_data_wait unix_state_lock(sk) tail = skb_peek_tail(&sk->sk_receive_queue) spin_lock(&sk->sk_receive_queue.lock) __skb_unlink(skb, &sk->sk_receive_queue) spin_unlock(&sk->sk_receive_queue.lock) consume_skb(skb) [frees the SKB] `tail != last`: false `tail`: true `tail->len != last_len` ***UAF*** ``` Fix the UAF by removing the read of tail->len; checking tail->len would only make sense if SKBs in the receive queue of a UNIX socket could grow, which can no longer happen. Kuniyuki explained: > When commit 869e7c62486e ("net: af_unix: implement stream sendpage > support") added sendpage() support, data could be appended to the last > skb in the receiver's queue. > > That's why we needed to check if the length of the last skb was changed > while waiting for new data in unix_stream_data_wait(). > > However, commit a0dbf5f818f9 ("af_unix: Support MSG_SPLICE_PAGES") and > commit 57d44a354a43 ("unix: Convert unix_stream_sendpage() to use > MSG_SPLICE_PAGES") refactored sendmsg(), and now data is always added > to a new skb. That means this fix is not suitable for kernels before 6.5.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 2b514574f7e88c8498027ee366fd6e7aae5aa4b5 , < 26342087fac93b3932e6af61dc91ec029cb8a623 (git)
Affected: 2b514574f7e88c8498027ee366fd6e7aae5aa4b5 , < 38bccb927d83d7d52e5b20015a172a0b6101d11e (git)
Affected: 2b514574f7e88c8498027ee366fd6e7aae5aa4b5 , < acdff9907478e82208475b1151700d0b71dcdc63 (git)
Affected: 2b514574f7e88c8498027ee366fd6e7aae5aa4b5 , < 5f162f95a95834f06a8ec6140889272ad12e842f (git)
Affected: 2b514574f7e88c8498027ee366fd6e7aae5aa4b5 , < be309f8eae8b474a4a617eaae01324da996fc719 (git)
Create a notification for this product.
Linux Linux Affected: 4.2
Unaffected: 0 , < 4.2 (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.92 , ≤ 6.12.* (semver)
Unaffected: 6.18.34 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/unix/af_unix.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "26342087fac93b3932e6af61dc91ec029cb8a623",
              "status": "affected",
              "version": "2b514574f7e88c8498027ee366fd6e7aae5aa4b5",
              "versionType": "git"
            },
            {
              "lessThan": "38bccb927d83d7d52e5b20015a172a0b6101d11e",
              "status": "affected",
              "version": "2b514574f7e88c8498027ee366fd6e7aae5aa4b5",
              "versionType": "git"
            },
            {
              "lessThan": "acdff9907478e82208475b1151700d0b71dcdc63",
              "status": "affected",
              "version": "2b514574f7e88c8498027ee366fd6e7aae5aa4b5",
              "versionType": "git"
            },
            {
              "lessThan": "5f162f95a95834f06a8ec6140889272ad12e842f",
              "status": "affected",
              "version": "2b514574f7e88c8498027ee366fd6e7aae5aa4b5",
              "versionType": "git"
            },
            {
              "lessThan": "be309f8eae8b474a4a617eaae01324da996fc719",
              "status": "affected",
              "version": "2b514574f7e88c8498027ee366fd6e7aae5aa4b5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/unix/af_unix.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Fix UAF read of tail-\u003elen in unix_stream_data_wait()\n\nunix_stream_data_wait() does skb_peek_tail(\u0026sk-\u003esk_receive_queue) without\nholding any lock that prevents SKBs on that queue from being dequeued and\nfreed.\nThis has been the case since commit 79f632c71bea (\"unix/stream: fix\npeeking with an offset larger than data in queue\").\nThe first consequence of this is that the pointer comparison\n`tail != last` can be false even if `last` semantically refers to an\nalready-freed SKB while `tail` is a new SKB allocated at the same address;\nwhich can cause unix_stream_data_wait() to wrongly keep blocking after new\ndata has arrived, but only in a weird scenario where a peeking recv() and\na normal recv() on the same socket are racing, which is probably not a\nreal problem.\n\nBut since commit 2b514574f7e8 (\"net: af_unix: implement splice for stream\naf_unix sockets\"), `tail` is actually dereferenced, which can cause UAF in\nthe following race scenario (where test_setup() runs single-threaded,\nand afterwards, test_thread1() and test_thread2() run concurrently in\ntwo threads:\n```\nstatic int socks[2];\nvoid test_setup(void) {\n  socketpair(AF_UNIX, SOCK_STREAM, 0, socks);\n  send(socks[1], \"A\", 1, 0);\n  int peekoff = 1;\n  setsockopt(socks[0], SOL_SOCKET, SO_PEEK_OFF, \u0026peekoff, sizeof(peekoff));\n}\nvoid test_thread1(void) {\n  char dummy;\n  recv(socks[0], \u0026dummy, 1, MSG_PEEK);\n}\nvoid test_thread2(void) {\n  char dummy;\n  recv(socks[0], \u0026dummy, 1, 0);\n  shutdown(socks[1], SHUT_WR);\n}\n```\n\nwhen racing like this:\n```\nthread1                       thread2\nunix_stream_read_generic\n  mutex_lock(\u0026u-\u003eiolock)\n  skb_peek(\u0026sk-\u003esk_receive_queue)\n  skb_peek_next(skb, \u0026sk-\u003esk_receive_queue)\n  mutex_unlock(\u0026u-\u003eiolock)\n                              unix_stream_read_generic\n                                unix_state_lock(sk)\n                                skb_peek(\u0026sk-\u003esk_receive_queue)\n                                unix_state_unlock(sk)\n  unix_stream_data_wait\n    unix_state_lock(sk)\n    tail = skb_peek_tail(\u0026sk-\u003esk_receive_queue)\n                                spin_lock(\u0026sk-\u003esk_receive_queue.lock)\n                                __skb_unlink(skb, \u0026sk-\u003esk_receive_queue)\n                                spin_unlock(\u0026sk-\u003esk_receive_queue.lock)\n                                consume_skb(skb) [frees the SKB]\n    `tail != last`: false\n    `tail`: true\n    `tail-\u003elen != last_len` ***UAF***\n```\n\nFix the UAF by removing the read of tail-\u003elen; checking tail-\u003elen would\nonly make sense if SKBs in the receive queue of a UNIX socket could grow,\nwhich can no longer happen.\n\nKuniyuki explained:\n\n\u003e When commit 869e7c62486e (\"net: af_unix: implement stream sendpage\n\u003e support\") added sendpage() support, data could be appended to the last\n\u003e skb in the receiver\u0027s queue.\n\u003e\n\u003e That\u0027s why we needed to check if the length of the last skb was changed\n\u003e while waiting for new data in unix_stream_data_wait().\n\u003e\n\u003e However, commit a0dbf5f818f9 (\"af_unix: Support MSG_SPLICE_PAGES\") and\n\u003e commit 57d44a354a43 (\"unix: Convert unix_stream_sendpage() to use\n\u003e MSG_SPLICE_PAGES\") refactored sendmsg(), and now data is always added\n\u003e to a new skb.\n\nThat means this fix is not suitable for kernels before 6.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-20T13:43:24.366Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/26342087fac93b3932e6af61dc91ec029cb8a623"
        },
        {
          "url": "https://git.kernel.org/stable/c/38bccb927d83d7d52e5b20015a172a0b6101d11e"
        },
        {
          "url": "https://git.kernel.org/stable/c/acdff9907478e82208475b1151700d0b71dcdc63"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f162f95a95834f06a8ec6140889272ad12e842f"
        },
        {
          "url": "https://git.kernel.org/stable/c/be309f8eae8b474a4a617eaae01324da996fc719"
        }
      ],
      "title": "af_unix: Fix UAF read of tail-\u003elen in unix_stream_data_wait()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64109",
    "datePublished": "2026-07-19T15:40:11.510Z",
    "dateReserved": "2026-07-19T07:54:57.034Z",
    "dateUpdated": "2026-07-20T13:43:24.366Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64109",
      "date": "2026-07-21",
      "epss": "0.00128",
      "percentile": "0.02882"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64109\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:52.233\",\"lastModified\":\"2026-07-20T15:17:09.670\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\naf_unix: Fix UAF read of tail-\u003elen in unix_stream_data_wait()\\n\\nunix_stream_data_wait() does skb_peek_tail(\u0026sk-\u003esk_receive_queue) without\\nholding any lock that prevents SKBs on that queue from being dequeued and\\nfreed.\\nThis has been the case since commit 79f632c71bea (\\\"unix/stream: fix\\npeeking with an offset larger than data in queue\\\").\\nThe first consequence of this is that the pointer comparison\\n`tail != last` can be false even if `last` semantically refers to an\\nalready-freed SKB while `tail` is a new SKB allocated at the same address;\\nwhich can cause unix_stream_data_wait() to wrongly keep blocking after new\\ndata has arrived, but only in a weird scenario where a peeking recv() and\\na normal recv() on the same socket are racing, which is probably not a\\nreal problem.\\n\\nBut since commit 2b514574f7e8 (\\\"net: af_unix: implement splice for stream\\naf_unix sockets\\\"), `tail` is actually dereferenced, which can cause UAF in\\nthe following race scenario (where test_setup() runs single-threaded,\\nand afterwards, test_thread1() and test_thread2() run concurrently in\\ntwo threads:\\n```\\nstatic int socks[2];\\nvoid test_setup(void) {\\n  socketpair(AF_UNIX, SOCK_STREAM, 0, socks);\\n  send(socks[1], \\\"A\\\", 1, 0);\\n  int peekoff = 1;\\n  setsockopt(socks[0], SOL_SOCKET, SO_PEEK_OFF, \u0026peekoff, sizeof(peekoff));\\n}\\nvoid test_thread1(void) {\\n  char dummy;\\n  recv(socks[0], \u0026dummy, 1, MSG_PEEK);\\n}\\nvoid test_thread2(void) {\\n  char dummy;\\n  recv(socks[0], \u0026dummy, 1, 0);\\n  shutdown(socks[1], SHUT_WR);\\n}\\n```\\n\\nwhen racing like this:\\n```\\nthread1                       thread2\\nunix_stream_read_generic\\n  mutex_lock(\u0026u-\u003eiolock)\\n  skb_peek(\u0026sk-\u003esk_receive_queue)\\n  skb_peek_next(skb, \u0026sk-\u003esk_receive_queue)\\n  mutex_unlock(\u0026u-\u003eiolock)\\n                              unix_stream_read_generic\\n                                unix_state_lock(sk)\\n                                skb_peek(\u0026sk-\u003esk_receive_queue)\\n                                unix_state_unlock(sk)\\n  unix_stream_data_wait\\n    unix_state_lock(sk)\\n    tail = skb_peek_tail(\u0026sk-\u003esk_receive_queue)\\n                                spin_lock(\u0026sk-\u003esk_receive_queue.lock)\\n                                __skb_unlink(skb, \u0026sk-\u003esk_receive_queue)\\n                                spin_unlock(\u0026sk-\u003esk_receive_queue.lock)\\n                                consume_skb(skb) [frees the SKB]\\n    `tail != last`: false\\n    `tail`: true\\n    `tail-\u003elen != last_len` ***UAF***\\n```\\n\\nFix the UAF by removing the read of tail-\u003elen; checking tail-\u003elen would\\nonly make sense if SKBs in the receive queue of a UNIX socket could grow,\\nwhich can no longer happen.\\n\\nKuniyuki explained:\\n\\n\u003e When commit 869e7c62486e (\\\"net: af_unix: implement stream sendpage\\n\u003e support\\\") added sendpage() support, data could be appended to the last\\n\u003e skb in the receiver\u0027s queue.\\n\u003e\\n\u003e That\u0027s why we needed to check if the length of the last skb was changed\\n\u003e while waiting for new data in unix_stream_data_wait().\\n\u003e\\n\u003e However, commit a0dbf5f818f9 (\\\"af_unix: Support MSG_SPLICE_PAGES\\\") and\\n\u003e commit 57d44a354a43 (\\\"unix: Convert unix_stream_sendpage() to use\\n\u003e MSG_SPLICE_PAGES\\\") refactored sendmsg(), and now data is always added\\n\u003e to a new skb.\\n\\nThat means this fix is not suitable for kernels before 6.5.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/unix/af_unix.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2b514574f7e88c8498027ee366fd6e7aae5aa4b5\",\"lessThan\":\"26342087fac93b3932e6af61dc91ec029cb8a623\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b514574f7e88c8498027ee366fd6e7aae5aa4b5\",\"lessThan\":\"38bccb927d83d7d52e5b20015a172a0b6101d11e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b514574f7e88c8498027ee366fd6e7aae5aa4b5\",\"lessThan\":\"acdff9907478e82208475b1151700d0b71dcdc63\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b514574f7e88c8498027ee366fd6e7aae5aa4b5\",\"lessThan\":\"5f162f95a95834f06a8ec6140889272ad12e842f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b514574f7e88c8498027ee366fd6e7aae5aa4b5\",\"lessThan\":\"be309f8eae8b474a4a617eaae01324da996fc719\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/unix/af_unix.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.143\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.92\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.34\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.11\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/26342087fac93b3932e6af61dc91ec029cb8a623\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/38bccb927d83d7d52e5b20015a172a0b6101d11e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5f162f95a95834f06a8ec6140889272ad12e842f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/acdff9907478e82208475b1151700d0b71dcdc63\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/be309f8eae8b474a4a617eaae01324da996fc719\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-20T17:08:16+00:00",
      "cve": "CVE-2026-64109",
      "id": "CVE-2026-64109",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "274",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: af_unix: Fix UAF read of tail-\u003elen in unix_stream_data_wait()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64109.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-21T12:59:32Z",
      "cve": "CVE-2026-64109",
      "id": "CVE-2026-64109",
      "initial_release_date": "2026-07-21T12:59:32Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64109",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64109.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.