CVE-2026-64177 - Vulnerability Details

- phonet/pep: disable BH around forwarded sk_receive_skb()

Description

In the Linux kernel, the following vulnerability has been resolved:

phonet/pep: disable BH around forwarded sk_receive_skb()

The networking receive path is usually run from softirq context, but
protocols that take the socket lock may have packets stored in the
backlog and processed later from process context. In that case
release_sock() -> __release_sock() drops the slock with spin_unlock_bh()
and then calls sk->sk_backlog_rcv() with bottom halves enabled.

Typical sk_backlog_rcv handlers process the socket whose backlog is
being drained, so the BH state at entry is irrelevant for the slocks
they touch. pep_do_rcv() is different: when the inbound skb targets an
existing PEP pipe, it forwards the skb to a different *child* socket
via sk_receive_skb(). That helper takes the child slock with
bh_lock_sock_nested(), which is just spin_lock_nested() and assumes BH
is already off. The same child slock therefore ends up acquired with
BH on (process path) and with BH off (softirq path):

process context softirq context
--------------- ---------------
release_sock(listener) __netif_receive_skb()
__release_sock() phonet_rcv()
spin_unlock_bh() __sk_receive_skb(listener)
[BH now ENABLED] [BH already disabled]
sk_backlog_rcv: sk_backlog_rcv:
pep_do_rcv() pep_do_rcv()
sk_receive_skb(child) sk_receive_skb(child)
bh_lock_sock_nested(child) bh_lock_sock_nested(child)
=> SOFTIRQ-ON-W => IN-SOFTIRQ-W

Lockdep flags this as inconsistent lock state, and it can become a real
self-deadlock if a softirq on the same CPU tries to receive to the same
child socket while its slock is held in the BH-enabled path:

WARNING: inconsistent lock state
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
(slock-AF_PHONET/1){+.?.}-{3:3}, at: __sk_receive_skb+0x1cf/0x900
__sk_receive_skb net/core/sock.c:563
sk_receive_skb include/net/sock.h:2022 [inline]
pep_do_rcv net/phonet/pep.c:675
sk_backlog_rcv include/net/sock.h:1190
__release_sock net/core/sock.c:3216
release_sock net/core/sock.c:3815
pep_sock_accept net/phonet/pep.c:879

Wrap the forwarded sk_receive_skb() in local_bh_disable() /
local_bh_enable() so the child slock is always acquired with BH off.
local_bh_disable() nests safely on the softirq path.

Discovered via in-house syzkaller fuzzing; the same root cause also
on the linux-6.1.y syzbot dashboard as extid 44f0626dd6284f02663c.
Reproduced under KASAN + LOCKDEP + PROVE_LOCKING, reproducer:
https://pastebin.com/A3t8xzCR

Published: 2026-07-19

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel phonet/pep driver contains a concurrency flaw that occurs when forwarding packets to a child socket. The parent and child sockets can acquire locks while the kernel’s bottom‑half (BH) state is inconsistent, leading lockdep to report an error and potentially turning into a self‑deadlock. If a deadlock occurs the driver stalls, which can bring the entire system to a halt. This flaw is a classic deadlock vulnerability (CWE‑833) and does not provide direct code execution or data disclosure, but it can deny availability for affected services.

Affected Systems

Any Linux kernel that includes the phonet/pep driver before the upstream fix, regardless of vendor, is vulnerable. This includes all recent kernel releases that compile the driver, as the flaw is intrinsic to the driver logic rather than a specific vendor build.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% and the lack of a KEV listing suggest a low likelihood of exploitation so far. Exploitation would require traffic that forces the kernel to process a packet on both a softIRQ and a process context for the same child socket. The attack vector is essentially network‑based traffic; local or remote attackers who can influence packet forwarding could trigger the deadlock.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9641458d3ec42def729fde64669abf07f3220cd5`	affected	< f08c45076e4fd8b0adbc5eb186d6e6a3e7350d7b
`9641458d3ec42def729fde64669abf07f3220cd5`	affected	< b2606c302d7f2b4ee48da05e32ed60aed1b0cd53
`9641458d3ec42def729fde64669abf07f3220cd5`	affected	< 02c04df84de709060f63e1d52ec67488c4f6f212
`9641458d3ec42def729fde64669abf07f3220cd5`	affected	< 8420aa4900417797323dd567ba9d1512280c2dc3
`9641458d3ec42def729fde64669abf07f3220cd5`	affected	< bd795f106b3889fb0706c6e4831c4b27e2b5666b
`9641458d3ec42def729fde64669abf07f3220cd5`	affected	< 84bc87beb4cd77670939b446326788e4c9b3db37
`9641458d3ec42def729fde64669abf07f3220cd5`	affected	< a3fc8f2dacd1c37325977fc1fbbf3d52141df99e
`9641458d3ec42def729fde64669abf07f3220cd5`	affected	< dbc81608e3a653dea6cf403f20cae35468b8ab9c

Linux

affected

Version	Status	Constraints
`2.6.28`	affected	—
`0`	unaffected	< 2.6.28
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.142`	unaffected	≤ 6.6.*
`6.12.92`	unaffected	≤ 6.12.*
`6.18.34`	unaffected	≤ 6.18.*
`7.0.11`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[9641458d3ec42def729fde64669abf07f3220cd5,f08c45076e4fd8b0adbc5eb186d6e6a3e7350d7b)`	affected	code_commit	—
`[9641458d3ec42def729fde64669abf07f3220cd5,b2606c302d7f2b4ee48da05e32ed60aed1b0cd53)`	affected	code_commit	—
`[9641458d3ec42def729fde64669abf07f3220cd5,02c04df84de709060f63e1d52ec67488c4f6f212)`	affected	code_commit	—
`[9641458d3ec42def729fde64669abf07f3220cd5,8420aa4900417797323dd567ba9d1512280c2dc3)`	affected	code_commit	—
`[9641458d3ec42def729fde64669abf07f3220cd5,bd795f106b3889fb0706c6e4831c4b27e2b5666b)`	affected	code_commit	—
`[9641458d3ec42def729fde64669abf07f3220cd5,84bc87beb4cd77670939b446326788e4c9b3db37)`	affected	code_commit	—
`[9641458d3ec42def729fde64669abf07f3220cd5,a3fc8f2dacd1c37325977fc1fbbf3d52141df99e)`	affected	code_commit	—
`[9641458d3ec42def729fde64669abf07f3220cd5,dbc81608e3a653dea6cf403f20cae35468b8ab9c)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.28`	affected	semver	—
`[0,2.6.28)`	unaffected	semver	—
`[5.10.258,5.11.0)`	unaffected	semver	—
`[5.15.209,5.16.0)`	unaffected	semver	—
`[6.1.175,6.2.0)`	unaffected	semver	—
`[6.6.142,6.7.0)`	unaffected	semver	—
`[6.12.92,6.13.0)`	unaffected	semver	—
`[6.18.34,6.19.0)`	unaffected	semver	—
`[7.0.11,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Verify if the current Linux kernel version includes a fix for the phonet/pep concurrency issue and, if available, upgrade to that version.
If an upgrade is not feasible, unload or disable the phonet or phonet/pep module (for example, with modprobe -r phonet or by removing CONFIG_PHONET from the kernel configuration).
Monitor kernel logs for lockdep warnings or softirq stalls that might indicate the deadlock condition, and verify that networking services remain responsive.

Generated by OpenCVE AI on August 1, 2026 at 07:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00165.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/02c04df84de709060f63e1d52ec67488c4f6f212
https://git.kernel.org/stable/c/8420aa4900417797323dd567ba9d1512280c2dc3
https://git.kernel.org/stable/c/84bc87beb4cd77670939b446326788e4c9b3db37
https://git.kernel.org/stable/c/a3fc8f2dacd1c37325977fc1fbbf3d52141df99e
https://git.kernel.org/stable/c/b2606c302d7f2b4ee48da05e32ed60aed1b0cd53
https://git.kernel.org/stable/c/bd795f106b3889fb0706c6e4831c4b27e2b5666b
https://git.kernel.org/stable/c/dbc81608e3a653dea6cf403f20cae35468b8ab9c
https://git.kernel.org/stable/c/f08c45076e4fd8b0adbc5eb186d6e6a3e7350d7b
https://lore.kernel.org/linux-cve-announce/2026071937-CVE-2026-64177-79cf@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64177
https://www.cve.org/CVERecord?id=CVE-2026-64177

History

Tue, 21 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-833
References		https://lore.kernel.org/linux-cve-announce/2026071937-CVE-2026-64177-79cf@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64177 https://www.cve.org/CVERecord?id=CVE-2026-64177
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 19 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: phonet/pep: disable BH around forwarded sk_receive_skb() The networking receive path is usually run from softirq context, but protocols that take the socket lock may have packets stored in the backlog and processed later from process context. In that case release_sock() -> __release_sock() drops the slock with spin_unlock_bh() and then calls sk->sk_backlog_rcv() with bottom halves enabled. Typical sk_backlog_rcv handlers process the socket whose backlog is being drained, so the BH state at entry is irrelevant for the slocks they touch. pep_do_rcv() is different: when the inbound skb targets an existing PEP pipe, it forwards the skb to a different child socket via sk_receive_skb(). That helper takes the child slock with bh_lock_sock_nested(), which is just spin_lock_nested() and assumes BH is already off. The same child slock therefore ends up acquired with BH on (process path) and with BH off (softirq path): process context softirq context --------------- --------------- release_sock(listener) __netif_receive_skb() __release_sock() phonet_rcv() spin_unlock_bh() __sk_receive_skb(listener) [BH now ENABLED] [BH already disabled] sk_backlog_rcv: sk_backlog_rcv: pep_do_rcv() pep_do_rcv() sk_receive_skb(child) sk_receive_skb(child) bh_lock_sock_nested(child) bh_lock_sock_nested(child) => SOFTIRQ-ON-W => IN-SOFTIRQ-W Lockdep flags this as inconsistent lock state, and it can become a real self-deadlock if a softirq on the same CPU tries to receive to the same child socket while its slock is held in the BH-enabled path: WARNING: inconsistent lock state inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. (slock-AF_PHONET/1){+.?.}-{3:3}, at: __sk_receive_skb+0x1cf/0x900 __sk_receive_skb net/core/sock.c:563 sk_receive_skb include/net/sock.h:2022 [inline] pep_do_rcv net/phonet/pep.c:675 sk_backlog_rcv include/net/sock.h:1190 __release_sock net/core/sock.c:3216 release_sock net/core/sock.c:3815 pep_sock_accept net/phonet/pep.c:879 Wrap the forwarded sk_receive_skb() in local_bh_disable() / local_bh_enable() so the child slock is always acquired with BH off. local_bh_disable() nests safely on the softirq path. Discovered via in-house syzkaller fuzzing; the same root cause also on the linux-6.1.y syzbot dashboard as extid 44f0626dd6284f02663c. Reproduced under KASAN + LOCKDEP + PROVE_LOCKING, reproducer: https://pastebin.com/A3t8xzCR
Title		phonet/pep: disable BH around forwarded sk_receive_skb()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/02c04df84de709060f63e1d52ec67488c4f6f212 https://git.kernel.org/stable/c/8420aa4900417797323dd567ba9d1512280c2dc3 https://git.kernel.org/stable/c/84bc87beb4cd77670939b446326788e4c9b3db37 https://git.kernel.org/stable/c/a3fc8f2dacd1c37325977fc1fbbf3d52141df99e https://git.kernel.org/stable/c/b2606c302d7f2b4ee48da05e32ed60aed1b0cd53 https://git.kernel.org/stable/c/bd795f106b3889fb0706c6e4831c4b27e2b5666b https://git.kernel.org/stable/c/dbc81608e3a653dea6cf403f20cae35468b8ab9c https://git.kernel.org/stable/c/f08c45076e4fd8b0adbc5eb186d6e6a3e7350d7b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T15:41:01.534Z

Updated: 2026-07-19T15:41:01.534Z

Reserved: 2026-07-19T07:54:57.039Z

Link: CVE-2026-64177

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64177 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-01T07:30:13Z

Weaknesses

CWE-833
Deadlock

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object