What is the CVSS score of CVE-2026-64011?

CVE-2026-64011 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-64011?

The Linux kernel's NFC LLCP subsystem contains a use-after-free vulnerability (CVE-2026-64011, CVSS 7.8) that enables local privilege escalation with high impact to confidentiality, integrity, and…. A patch is available.

How to fix or mitigate CVE-2026-64011?

Within 24 hours: Identify all Linux systems with NFC hardware or NFC drivers enabled in production environments; obtain the vendor-released patch from your Linux distribution's security advisory. Within 7 days: Deploy the patched kernel to a representative staging environment, validate system functionality and NFC operations, and confirm successful boot and runtime behavior. Within 30 days: Complete rollout of the patched kernel to all affected production systems, prioritizing devices where local user access is most likely or least controlled.

Linux Kernel CVE-2026-64011

EUVD-2026-45584 HIGH

2026-07-19 Linux

GHSA-qcwr-3hxc-6w36

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local unprivileged user triggers a UAF with no user interaction (AV:L/PR:L/UI:N); kernel memory corruption yields privilege-escalation/DoS potential, so C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:51 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 17:19 EUVD

CVE Published

Jul 19, 2026 - 14:56 cve.org

HIGH 7.8

CVE Published

Jul 19, 2026 - 14:56 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

nfc: llcp: Fix use-after-free in llcp_sock_release()

llcp_sock_release() unconditionally unlinks the socket from the local sockets list. However, if the socket is still in connecting state, it is on the connecting list.

Fix this by checking the socket state and unlinking from the correct list.

AnalysisAI

Local privilege escalation risk arises from a use-after-free in the Linux kernel's NFC LLCP subsystem, where llcp_sock_release() unconditionally unlinks a socket from the local sockets list even when the socket is still in the connecting state and actually resides on the connecting list. A local user able to open NFC LLCP sockets can trigger memory corruption during socket release, with high confidentiality, integrity and availability impact per the CVSS 7.8 rating. No public exploit identified at time of analysis, and EPSS is low (0.18%), consistent with a local-only, hardware-gated attack surface.

Technical ContextAI

The flaw lives in the NFC (Near Field Communication) Logical Link Control Protocol (LLCP) implementation of the Linux networking stack (net/nfc/llcp_sock.c). LLCP maintains separately linked lists of sockets by state - bound/local sockets versus sockets mid-connection ('connecting'). The bug is a classic CWE-416 Use-After-Free: llcp_sock_release() assumed every socket was on the local sockets list and unlinked it from there, but a socket still in the connecting state lives on the connecting list, so the release path manipulates and frees list state incorrectly, leaving a dangling reference that can later be dereferenced. The CPE data (cpe:2.3:a:linux:linux) identifies upstream Linux as the affected product; exploitation is only reachable where CONFIG_NFC and the LLCP socket family are compiled in and an NFC device/context is available.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, or mainline 7.1 - as shipped by your distribution, then reboot to load the patched kernel. The upstream fix checks the socket state and unlinks it from the correct list (local vs connecting) in llcp_sock_release(); commits are at https://git.kernel.org/stable/c/2dfdaaf7d933b676124aadec6698825e95f94fe9 and its stable backports. Where immediate patching is not possible, a concrete compensating control is to remove the attack surface by unloading and blacklisting the NFC modules (e.g. blacklist the nfc and nfc_llcp modules, or build/deploy kernels without CONFIG_NFC); the trade-off is that NFC functionality (contactless/peer-to-peer features) becomes unavailable on that host. On systems that do not use NFC this control is low-impact; on NFC-dependent endpoints or kiosks it will break intended functionality, so schedule the kernel update there instead.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64011 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64011

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code