Skip to main content

Linux Kernel CVE-2026-64005

| EUVDEUVD-2026-45578 HIGH
2026-07-19 Linux GHSA-hrwp-cv9c-vc93
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local privileged access needed (AV:L/PR:L); reliance on an initialization race raises attack complexity to AC:H; kernel list corruption yields full C:H/I:H/A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 16:47 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 17:19 EUVD
CVE Published
Jul 19, 2026 - 14:56 cve.org
HIGH 7.8
CVE Published
Jul 19, 2026 - 14:56 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/smc: Do not re-initialize smc hashtables

INIT_HLIST_HEAD(&smc_v*_hashinfo.ht) are called after smc_nl_init(), proto_register() and sock_register(). This can lead to smc_v*_hashinfo.ht being reset even though hash entries already exist and are being used, possibly resulting in a corrupted list.

Remove unnecessary and dangerous re-initialisation of smc_v*_hashinfo.ht in smc_init(); it is implicitly initialised to zero anyhow. Add HLIST_HEAD_INIT to the definitions for clarity.

AnalysisAI

Memory corruption in the Linux kernel's SMC (Shared Memory Communications) networking subsystem arises because smc_init() re-runs INIT_HLIST_HEAD() on the smc_v1/smc_v2 hashtables after they may already hold live hash entries, resetting the list heads and corrupting an in-use linked list. A local user able to trigger SMC socket activity during the vulnerable window can cause list corruption leading to high confidentiality, integrity, and availability impact per the CVSS 7.8 (AV:L) rating. This is not actively exploited - no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.18%.

Technical ContextAI

SMC (Shared Memory Communications, net/smc) is an RDMA-capable kernel protocol family that maintains connection state in hash tables (smc_v1_hashinfo.ht and smc_v2_hashinfo.ht). During module/subsystem startup, smc_init() performs registration steps - smc_nl_init(), proto_register(), and sock_register() - that can expose the protocol to socket creation before initialization finishes. The bug is a classic improper-initialization/ordering defect (no CWE assigned; behaviorally CWE-665 Improper Initialization leading to CWE-664/list corruption): INIT_HLIST_HEAD() is invoked on the hashtable heads AFTER those registration calls, so any entries already inserted are orphaned when the head pointer is zeroed, corrupting the HList. The fix removes the redundant re-initialization (the static hashinfo is implicitly zeroed at load) and adds HLIST_HEAD_INIT to the definitions for clarity. The CPE data identifies the affected component generically as cpe:2.3:a:linux:linux, i.e. the mainline kernel tree.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, or 7.1 or later on the corresponding branch. Apply your distribution's kernel update that incorporates the upstream commits listed at git.kernel.org/stable/c/9e4389b0038781f19f97895186ed941ff8ac1678 (and sibling per-branch commits) and reboot to load the corrected kernel. Where immediate patching is not possible, the most effective compensating control is to prevent use of the SMC protocol family: blacklist the smc kernel module (e.g. via modprobe blacklist and install /bin/false, then confirm it is not already loaded) so the vulnerable smc_init() path is never exercised - the trade-off is that any workload relying on SMC-R/SMC-D RDMA acceleration will lose that capability. On systems that do not use SMC this control has no functional impact. Verify remediation with uname -r against the fixed versions above; do not rely on invented version numbers beyond those in the advisory.

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64005 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy