Menu

Star on GitHub · 3.2k

CVE-2026-64415

In the Linux kernel, the following vulnerability has been resolved: mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup We hit a real softlockup in an internal stress…

Published Jul 25, 2026EPSS 0.09%

Overview

CVE-2026-64415 is a known-severity vulnerability. It was published on July 25, 2026.

Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup

We hit a real softlockup in an internal stress test environment. The

workload was LTP memory/swap stress on a large arm64 machine, with 320

CPUs, about 1TB memory and an 8.6GB swap device. The system was under

heavy load and the swap device had a large number of full clusters. The

softlockup was triggered during a stress test after about 3 days.

So, add periodic cond_resched() calls during large full_clusters

reclaim operations to prevent softlockup issues.

Detailed call trace as follow:

PID: 3817773 TASK: ffff0883bb28b780 CPU: 48 COMMAND: "kworker/48:7"

#0 [ffff800080183d10] __crash_kexec at ffffa4c1361e5de4

#1 [ffff800080183d90] panic at ffffa4c1360d5e9c

#2 [ffff800080183e20] watchdog_timer_fn at ffffa4c136231fa8

...

#16 [ffff8000c4ad3cb0] swap_cache_del_folio at ffffa4c1363e1614

#17 [ffff8000c4ad3ce0] __try_to

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Frequently asked questions

What is CVE-2026-64415?

CVE-2026-64415 is a known-severity vulnerability. It was published on July 25, 2026.

How severe is CVE-2026-64415?

CVSS score information is not yet available for this vulnerability. Check back as the CVE record is updated by NVD analysts.

How do I fix or remediate CVE-2026-64415?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2026-64415?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2026-64415 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.