What is the CVSS score of CVE-2026-64004?

CVE-2026-64004 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-64004?

A kernel vulnerability in IBM Z and s390 Linux systems allows any local system user to trigger a kernel panic through HiperSockets networking, causing unplanned downtime for mainframe environments.. A patch is available.

How to fix or mitigate CVE-2026-64004?

Within 24 hours, identify which systems in your environment run s390/IBM Z Linux with IUCV/HiperSockets networking enabled. Within 7 days, obtain the patched Linux kernel version from your vendor (typically RHEL/SLES/Ubuntu for s390x) and test in a non-production environment. Within 30 days, deploy the patched kernel across all affected production systems following your standard change management process, scheduling maintenance windows as needed for mainframe restarts.

Linux Kernel CVE-2026-64004

EUVD-2026-45577 HIGH

2026-07-19 Linux

GHSA-f6mc-xr5x-m669

Denial Of Service Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

4.7 MEDIUM

Local unprivileged user (AV:L/PR:L) must win a teardown race (AC:H); impact is a NULL-deref kernel crash only, so C:N/I:N/A:H rather than the input's C:H/I:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:47 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 17:19 EUVD

CVE Published

Jul 19, 2026 - 14:56 cve.org

HIGH 7.8

CVE Published

Jul 19, 2026 - 14:56 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/iucv: fix locking in .getsockopt

Mirror iucv_sock_setsockopt() and wrap the whole switch in lock_sock()/release_sock(). The pre-existing SO_MSGLIMIT-only lock becomes redundant and is removed.

Any AF_IUCV HIPER user can potentially crash the kernel by racing recvmsg() with getsockopt(SO_MSGSIZE): the SO_MSGSIZE arm dereferences iucv->hs_dev->mtu after iucv_sock_close() (called from the racing recvmsg()) has set hs_dev to NULL, producing a NULL pointer dereference oops.

AnalysisAI

Local denial of service in the Linux kernel's AF_IUCV networking stack allows any unprivileged user on an s390/IBM Z host to crash the machine by racing recvmsg() against getsockopt(SO_MSGSIZE) on a HiperSockets (HIPER) socket. The .getsockopt handler dereferenced iucv->hs_dev->mtu without holding lock_sock(), so a concurrent iucv_sock_close() (triggered from recvmsg) could set hs_dev to NULL between the check and the dereference, producing a NULL pointer dereference oops. EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis; the upstream fix wraps the entire getsockopt switch in lock_sock()/release_sock() to mirror the existing setsockopt locking.

Technical ContextAI

AF_IUCV is the Inter-User Communication Vehicle socket family, an IBM Z (s390) specific transport that carries datagrams either over the classic z/VM IUCV channel or over HiperSockets in 'HIPER' mode. In HIPER mode the socket keeps a pointer (iucv->hs_dev) to the backing network device, whose MTU is returned to callers of getsockopt(SO_MSGSIZE). The root cause is a classic use-after-teardown / unsynchronized concurrent access (conceptually CWE-476 NULL pointer dereference stemming from a CWE-362 race condition): iucv_sock_getsockopt() read hs_dev outside socket locking while iucv_sock_close() (invoked on the recvmsg path) concurrently nulled it, so the getsockopt arm dereferenced a freed/cleared pointer. The CPE data scopes this to cpe:2.3:a:linux:linux, i.e. the mainline Linux kernel, but the affected code path only exists in the net/iucv subsystem compiled for s390.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, or 7.0.12 (or later mainline), whichever matches your branch, as published at git.kernel.org (e.g. https://git.kernel.org/stable/c/884eb247b74d86db97e3a37f0d6fc8e1e83590dd) and tracked in NVD https://nvd.nist.gov/vuln/detail/CVE-2026-64004. Apply your distribution's corresponding kernel update once it ships the backport. Because the flaw is only reachable through AF_IUCV HiperSockets sockets on s390, a targeted compensating control on unpatched mainframes is to restrict or disable AF_IUCV where it is not required - for example unload/blacklist the af_iucv module (modprobe -r af_iucv or a /etc/modprobe.d blacklist) so unprivileged users cannot open these sockets; the trade-off is that any workload relying on IUCV/HiperSockets guest-to-guest communication will break, so validate that no z/VM guest networking depends on it before applying.

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64004 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64004

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code