CVE-2026-64514 - Vulnerability Details

- userfaultfd: gate must_wait writability check on pte_present()

Description

In the Linux kernel, the following vulnerability has been resolved:

userfaultfd: gate must_wait writability check on pte_present()

userfaultfd_must_wait() and userfaultfd_huge_must_wait() read the PTE
without taking the page table lock and then apply pte_write() /
huge_pte_write() to it. Those accessors decode bits from the present
encoding only; on a swap or migration entry they read the offset bits that
happen to share the same position and return an undefined result.

The intent of the check is "is this fault still WP-blocked?". A
non-marker swap entry means the page is in transit -- the userfault
context the original fault delivered against is no longer the same, and
the swap-in or migration completion path will re-deliver a fresh fault if
userspace still needs to handle it. Worst case under the current code the
garbage write bit says "wait", and the thread stays asleep until a
UFFDIO_WAKE that may never arrive.

Gate the writability check on pte_present() so the lockless re-check only
inspects present-PTE bits when the entry is actually present. The
non-present, non-marker case returns "don't wait" and lets the fault path
retry.

Published: 2026-07-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises in the Linux kernel's userfaultfd implementation, where the functions userfaultfd_must_wait() and userfaultfd_huge_must_wait() read page table entries without holding the page table lock and incorrectly interpret the write bit from a swap or migration entry. This misreading can cause the kernel to believe the fault is still write‑protected and put a thread to sleep indefinitely, leading to a denial‑of‑service condition by hanging userthreads. The weakness stems from using uninitialized or incorrectly decoded data to make scheduling decisions, which violates the expected synchronization and data integrity guarantees of the kernel.

Affected Systems

The issue affects any Linux system running versions of the kernel that contain the unpatched userfaultfd code. The known affected product is Linux:Linux with no specific version ranges provided in the CNA data, but the patch is available in recent stable kernel releases.

Risk and Exploitability

The vulnerability has a CVSS score of 5.5, indicating moderate severity, and an EPSS score of less than 1%, which shows a low probability of exploitation in the wild. It is not listed in CISA's KEV catalog. It is inferred that the attack vector is local: a user or application triggering a page fault in a process that uses userfaultfd could cause the thread to stall. The worst‑case scenario manifests as reduced system responsiveness or a stalled thread rather than data disclosure or privilege escalation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`369cd2121be440543280b91056de187f625d0dbb`	affected	< a5700a4c1c9099ac2ac73fe8a09cf059972e0d2f
`369cd2121be440543280b91056de187f625d0dbb`	affected	< d4026417e8184d13850a0bad4d96ceb6ed9f7152
`369cd2121be440543280b91056de187f625d0dbb`	affected	< 29e6f952c5fb7dc1d6b90fe5b7f36063d44ddae0
`369cd2121be440543280b91056de187f625d0dbb`	affected	< 5f4dbdb0a87596214076b20b94f2b71b522170b3
`369cd2121be440543280b91056de187f625d0dbb`	affected	< a6e9a4939e359599701b1da351e84f72e021443a
`369cd2121be440543280b91056de187f625d0dbb`	affected	< 60d696a037eeeedfb57756dfe7ec08a1587c8631
`369cd2121be440543280b91056de187f625d0dbb`	affected	< 710183888174639a15fcec16cd1af766b8480bb7
`369cd2121be440543280b91056de187f625d0dbb`	affected	< 8e80af52db652fbc41320eee45a4f73bc029faf2

Linux

affected

Version	Status	Constraints
`4.11`	affected	—
`0`	unaffected	< 4.11
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[369cd2121be440543280b91056de187f625d0dbb,a5700a4c1c9099ac2ac73fe8a09cf059972e0d2f)`	affected	code_commit	—
`[369cd2121be440543280b91056de187f625d0dbb,d4026417e8184d13850a0bad4d96ceb6ed9f7152)`	affected	code_commit	—
`[369cd2121be440543280b91056de187f625d0dbb,29e6f952c5fb7dc1d6b90fe5b7f36063d44ddae0)`	affected	code_commit	—
`[369cd2121be440543280b91056de187f625d0dbb,5f4dbdb0a87596214076b20b94f2b71b522170b3)`	affected	code_commit	—
`[369cd2121be440543280b91056de187f625d0dbb,a6e9a4939e359599701b1da351e84f72e021443a)`	affected	code_commit	—
`[369cd2121be440543280b91056de187f625d0dbb,60d696a037eeeedfb57756dfe7ec08a1587c8631)`	affected	code_commit	—
`[369cd2121be440543280b91056de187f625d0dbb,710183888174639a15fcec16cd1af766b8480bb7)`	affected	code_commit	—
`[369cd2121be440543280b91056de187f625d0dbb,8e80af52db652fbc41320eee45a4f73bc029faf2)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.11`	affected	generic	—
`[0,4.11)`	unaffected	semver	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply an updated Linux kernel that includes the fix for CVE-2026-64514.
Reboot after patching to ensure all processes use the new kernel image.
If immediate kernel upgrade is not possible, consider disabling the userfaultfd mechanism or restricting its use to trusted processes to reduce the potential for exploitation.

Generated by OpenCVE AI on August 4, 2026 at 14:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00177.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/29e6f952c5fb7dc1d6b90fe5b7f36063d44ddae0
https://git.kernel.org/stable/c/5f4dbdb0a87596214076b20b94f2b71b522170b3
https://git.kernel.org/stable/c/60d696a037eeeedfb57756dfe7ec08a1587c8631
https://git.kernel.org/stable/c/710183888174639a15fcec16cd1af766b8480bb7
https://git.kernel.org/stable/c/8e80af52db652fbc41320eee45a4f73bc029faf2
https://git.kernel.org/stable/c/a5700a4c1c9099ac2ac73fe8a09cf059972e0d2f
https://git.kernel.org/stable/c/a6e9a4939e359599701b1da351e84f72e021443a
https://git.kernel.org/stable/c/d4026417e8184d13850a0bad4d96ceb6ed9f7152
https://lore.kernel.org/linux-cve-announce/2026072555-CVE-2026-64514-11d4@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64514
https://www.cve.org/CVERecord?id=CVE-2026-64514

History

Tue, 04 Aug 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-368

Mon, 03 Aug 2026 18:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-665

Thu, 30 Jul 2026 02:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665

Wed, 29 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026072555-CVE-2026-64514-11d4@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64514 https://www.cve.org/CVERecord?id=CVE-2026-64514
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: userfaultfd: gate must_wait writability check on pte_present() userfaultfd_must_wait() and userfaultfd_huge_must_wait() read the PTE without taking the page table lock and then apply pte_write() / huge_pte_write() to it. Those accessors decode bits from the present encoding only; on a swap or migration entry they read the offset bits that happen to share the same position and return an undefined result. The intent of the check is "is this fault still WP-blocked?". A non-marker swap entry means the page is in transit -- the userfault context the original fault delivered against is no longer the same, and the swap-in or migration completion path will re-deliver a fresh fault if userspace still needs to handle it. Worst case under the current code the garbage write bit says "wait", and the thread stays asleep until a UFFDIO_WAKE that may never arrive. Gate the writability check on pte_present() so the lockless re-check only inspects present-PTE bits when the entry is actually present. The non-present, non-marker case returns "don't wait" and lets the fault path retry.
Title		userfaultfd: gate must_wait writability check on pte_present()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/29e6f952c5fb7dc1d6b90fe5b7f36063d44ddae0 https://git.kernel.org/stable/c/5f4dbdb0a87596214076b20b94f2b71b522170b3 https://git.kernel.org/stable/c/60d696a037eeeedfb57756dfe7ec08a1587c8631 https://git.kernel.org/stable/c/710183888174639a15fcec16cd1af766b8480bb7 https://git.kernel.org/stable/c/8e80af52db652fbc41320eee45a4f73bc029faf2 https://git.kernel.org/stable/c/a5700a4c1c9099ac2ac73fe8a09cf059972e0d2f https://git.kernel.org/stable/c/a6e9a4939e359599701b1da351e84f72e021443a https://git.kernel.org/stable/c/d4026417e8184d13850a0bad4d96ceb6ed9f7152

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:52:05.878Z

Updated: 2026-07-25T08:52:05.878Z

Reserved: 2026-07-19T15:36:31.793Z

Link: CVE-2026-64514

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-07-25T10:17:37.633

Modified: 2026-07-25T10:17:37.633

Link: CVE-2026-64514

Redhat

Severity : Low

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64514 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-04T14:15:10Z

Weaknesses

CWE-368
Context Switching Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object