In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport closes Threads parked in svc_rdma_sq_wait() on sc_sq_ticket_wait or sc_send_wait can hang indefinitely in TASK_UNINTERRUPTIBLE state across transport teardown, pinning svc_xprt references and blocking svc_rdma_free(). The close path sets XPT_CLOSE before invoking xpo_detach and both wait_event predicates include an XPT_CLOSE term, but the predicates are re-evaluated only on wakeup. sc_sq_ticket_wait has no completion-driven wake path; it is advanced solely by the chained ticket handoff inside svc_rdma_sq_wait() itself. Without an explicit wake at close, parked threads never observe XPT_CLOSE, hold their svc_xprt_get reference forever, and svc_rdma_free() blocks on xpt_ref dropping to zero. Two close entry points reach this transport. Local teardown runs svc_rdma_detach() from svc_handle_xprt() -> svc_delete_xprt() -> xpo_detach() on a worker thread. A remote disconnect ar
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-64281 is a denial-of-service vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) transport layer that causes worker threads to hang indefinitely during transport shutdown. When svc_rdma_sq_wait() threads park themselves waiting for send queue capacity or send completion, they can remain blocked in TASK_UNINTERRUPTIBLE state even after the transport closes. This affects any system running vulnerable Linux kernels that use RDMA-based NFS services (nfsrdma), preventing proper cleanup of transport references and blocking the svc_rdma_free() function. The impact cascades into resource exhaustion and service unavailability, making this particularly critical for high-performance storage and HPC environments relying on RDMA.
While CVE-2026-64281 lacks mapped MITRE ATT&CK techniques and CWE classification, Casky's platform would detect the underlying attack surface through resource exhaustion and persistence patterns. Practitioners using Casky would identify suspicious behaviors including: threads stuck in uninterruptible sleep states persisting across expected service lifecycle events, abnormal kernel memory retention tied to transport structures, and failed cleanup operations during graceful shutdown sequences. Claude AI's extended reasoning would correlate these observations with the kernel's synchronization primitives, flagging cases where wait predicates contain XPT_CLOSE conditions but lack proper wakeup mechanisms—a pattern indicative of incomplete synchronization logic that could be exploited for denial-of-service. Detection focuses on monitoring transport teardown sequences and thread state transitions rather than network-based IOCs.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-64281. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation