CVE-2026-64592— riscv: mm: Unconditionally sfence.vma for spurious fault
Possible ATT&CK Techniques 1AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 10
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 503638e0babf364061bc50fca5103b00a56cc50a< c4df24702bfc3cd2bed7746b94dc6139a3fa5428 | affected |
503638e0babf364061bc50fca5103b00a56cc50a< 4d730cab96e6b75e4a07c4baf37294ebc07f795e | affected | ||
503638e0babf364061bc50fca5103b00a56cc50a< ede985ff4b569ed2454024f8bb107a6729fe08aa | affected | ||
503638e0babf364061bc50fca5103b00a56cc50a< 1b2c6b56a9fa0dcbef461039937de22b1cbecc7d | affected | ||
6.12 | affected | ||
< 6.12 | unaffected | ||
6.12.96≤ 6.12.* | unaffected | ||
6.18.39≤ 6.18.* | unaffected | ||
| … +2 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-64592
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
riscv: mm: Unconditionally sfence.vma for spurious fault
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Unconditionally sfence.vma for spurious fault Svvptc does not guarantee that it's safe to just return here. Since we have already cleared our bit, if, theoretically, the bounded timeframe for the accessed page to become valid still hasn't happened after sret, we could fault again and actually crash. Hopefully, these spurious faults should be rare enough that this is an acceptable slowdown.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 6.12版本存在安全漏洞，该漏洞源于RISC-V架构内存管理中未对虚假故障无条件执行sfence.vma，可能导致再次触发故障并导致系统崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-64592
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-64592
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-64592 (3)
Same Patch Batch · Linux · 2026-08-06 · 22 CVEs total
| CVE-2026-64597 | 9.8 CRITICAL | smb: client: fix double-free in SMB2_close() replay |
| CVE-2026-64586 | 8.8 HIGH | wifi: brcmfmac: drain bus_reset work on device removal |
| CVE-2026-64598 | 8.8 HIGH | smb/client: Fix error code in smb2_aead_req_alloc() |
| CVE-2026-64584 | 7.8 HIGH | usb: gadget: f_midi: cancel pending IN work before freeing the midi object |
| CVE-2026-64585 | 7.8 HIGH | can: esd_usb: kill anchored URBs before freeing netdevs |
| CVE-2026-64588 | 7.8 HIGH | fuse-uring: fix data races on ring->ready |
| CVE-2026-64583 | 7.8 HIGH | usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown |
| CVE-2026-64601 | 7.8 HIGH | ALSA: us144mkii: capture_urb_complete: redundant usb_anchor_urb corrupts anchor list on ea |
| CVE-2026-64599 | 7.8 HIGH | crypto: amlogic - avoid double cleanup in meson_crypto_probe() |
| CVE-2026-64587 | 7.0 HIGH | net: ethernet: arc: emac: quiesce interrupts before requesting IRQ |
| CVE-2026-68480 | x86/bugs: Make Safe-RET robust against interrupt injection | |
| CVE-2026-64604 | KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode | |
| CVE-2026-64603 | platform/x86: intel-hid: Protect ACPI notify handler against recursion | |
| CVE-2026-64602 | iio: adc: spear: Initialize completion before requesting IRQ | |
| CVE-2026-64596 | libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo() | |
| CVE-2026-64595 | HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove() | |
| CVE-2026-64593 | btrfs: do not trim a device which is not writeable | |
| CVE-2026-64594 | usb: gadget: f_fs: initialize reset_work at allocation time | |
| CVE-2026-64591 | iommu/vt-d: Avoid WARNING in sva unbind path | |
| CVE-2026-64590 | dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning |
Showing top 20 of 22 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-74439
iommu/vt-d: Clear Present bit before tearing down scalable-m - CVE-2026-74438
crypto: sun4i-ss - Remove insecure and unused rng_alg - CVE-2026-74436
rxrpc: serialize kernel accept preallocation with socket tea - CVE-2026-74437
media: uvcvideo: Fix deadlock if uvc_status_stop is called f - CVE-2026-74435
rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc
Same vendor: Linux
- CVE-2026-74439
iommu/vt-d: Clear Present bit before tearing down scalable-m - CVE-2026-74438
crypto: sun4i-ss - Remove insecure and unused rng_alg - CVE-2026-74436
rxrpc: serialize kernel accept preallocation with socket tea - CVE-2026-74437
media: uvcvideo: Fix deadlock if uvc_status_stop is called f - CVE-2026-74435
rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc
V. Comments for CVE-2026-64592
No comments yet