Improper Memory Management in Linux Kernel Networking

CVE-2026-64002

What is CVE-2026-64002?

A vulnerability in the Linux kernel's ipv4 networking stack relates to the improper timing of freeing memory associated with net->ipv4.sysctl_local_reserved_ports. The issue occurs when the function ipv4_sysctl_exit_net() is executed too early, resulting in potential use-after-free conditions. This can create vulnerabilities for processes relying on sysctl settings, notably those referenced in /proc/sys/net/ipv4/ip_local_reserved_ports. Correctly managing the lifecycle of these resources is essential to ensure that threads that depend on the sysctls are no longer active before the memory is freed.

References