What is the CVSS score of CVE-2026-64020?

CVE-2026-64020 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-64020?

A memory leak in the Linux kernel's NVMe-PCIe driver (kernel 6.17) causes cumulative kernel memory exhaustion on systems using peer-to-peer DMA, potentially leading to system instability or denial of…. A patch is available.

How to fix or mitigate CVE-2026-64020?

Within 24 hours, identify all Linux hosts running kernel 6.17 with NVMe peer-to-peer DMA capabilities using 'uname -r' and device enumeration tools. Within 7 days, deploy the patched stable kernel release to affected systems and verify via kernel reload confirmation. Within 30 days, complete full infrastructure audit to confirm all kernel 6.17 instances across production, data centers, and edge deployments have been updated, and document remediation completion.

Linux Kernel CVE-2026-64020

EUVD-2026-45593 HIGH

2026-07-19 Linux

GHSA-vrp7-59vv-qgvc

Information Disclosure Linux

High

Disputed · 7.5 Vendor: Linux

Severity by source

Sources disagree (Low–High)

Vendor (Linux) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

3.3 LOW

Triggered locally via NVMe P2PDMA I/O, not network-reachable (AV:L); requires ability to submit I/O on a privileged/config-enabled path (PR:L); a slow cumulative memory leak yields limited availability impact (A:L), no C/I effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:53 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.5 (HIGH)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:39 cve.org

HIGH 7.5

CVE Published

Jul 19, 2026 - 15:39 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

nvme-pci: fix dma_vecs leak on p2p memory

We don't unmap P2P memory, so we don't need to track it. The dma_vec allocation was getting leaked on the completion.

AnalysisAI

Memory (kmalloc) leak in the Linux kernel's nvme-pci driver allows exhaustion of kernel memory over time on hosts using NVMe peer-to-peer (P2P) DMA. Because P2P memory is never unmapped, the driver has no need to track it, yet the dma_vec allocation used for tracking was never freed on I/O completion, leaking on every affected request. The flaw affects kernel 6.17 and is fixed in stable; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%).

Technical ContextAI

The issue lives in the NVMe PCIe host driver (drivers/nvme/host/pci.c) path that handles peer-to-peer DMA (P2PDMA) - a feature letting one PCIe device DMA directly to/from another device's memory (e.g. a GPU or CMB) without bouncing through system RAM. When a request targets P2P memory, the driver allocates a dma_vec structure to describe the mapping but, since P2P regions are not unmapped, that allocation is never released on completion, producing a slow kernel heap leak. The root cause class is a missing-release / memory-leak defect (CWE-401-style, though CWE is marked N/A here); it is a resource-management bug, not a memory-corruption or disclosure bug. The provided 'Information Disclosure' tag conflicts with the CVSS impact (C:N), and should be treated as a mislabel - the actual impact is availability via resource exhaustion.

RemediationAI

Patch available per vendor advisory - apply the stable kernel update containing fix commits 85686c72966c5ee637893f124ddb31a1cace7bee and 24ea0de233d9ebb5ebd6f6018eaf2084af25e3dd (https://git.kernel.org/stable/c/85686c72966c5ee637893f124ddb31a1cace7bee and https://git.kernel.org/stable/c/24ea0de233d9ebb5ebd6f6018eaf2084af25e3dd), or upgrade to the corresponding distribution kernel that backports them. If you cannot patch immediately, the practical compensating control is to avoid the vulnerable path: disable or do not enable NVMe peer-to-peer DMA (P2PDMA) for affected workloads, which prevents the dma_vec allocation from being created at all - the trade-off is loss of direct device-to-device DMA acceleration for GPU/storage pipelines that rely on it. Monitoring kernel slab/memory usage and scheduling reboots can also bound impact until patched, at the cost of downtime.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64020 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64020

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code