What is the CVSS score of CVE-2026-64025?

CVE-2026-64025 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Linux CVE-2026-64025

EUVD-2026-45598 CRITICAL

Race Condition (CWE-362)

2026-07-19 Linux

GHSA-r22g-q228-2mx8

Information Disclosure Linux Race Condition

Critical

Disputed · 9.8 Vendor: Linux

View

Vulnerability Assessment

Weakness

CWE

CWE-362

OWASP Top 10:2025

A06:2025 - Insecure Design

ASVS 5.0

V15 - Secure Coding and Architecture Concurrency control, locking

MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 20, 2026

Use-after-free in the Linux kernel's BPF sockmap (skmsg) receive path arises when a socket is added to a BPF_SK_SKB_VERDICT sockmap before kernel TLS (kTLS) RX is configured, letting sk_psock_verdict_data_ready() drain the TCP receive queue that the TLS strparser believes it owns. The mismatch leaves the strparser's frag_list pointing at freed, psock-owned skbs, which tls_decrypt_sg() then walks, corrupting kernel memory. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis, but a kernel-space UAF with high confidentiality, integrity, and availability impact makes this a meaningful local privilege-escalation and denial-of-service risk on affected builds.

Affected VersionsENISA

Linux patch: 0

Linux ef5659280eb13e8ac31c296f58cfdfa1684ac06b <c9ea01768903ae47f210cd457af1dead6de7a9c3

Linux patch: 7.0.11

Linux patch: 6.12.92

Linux ef5659280eb13e8ac31c296f58cfdfa1684ac06b <7c8cf21bc4efb4af18d6096db3f8bd06d622251c

Linux patch: 6.18.34

Linux patch: 7.1

Linux ef5659280eb13e8ac31c296f58cfdfa1684ac06b <8a52139560f833c3975032e1f5762611e3a36d71

Linux 5.10

Linux ef5659280eb13e8ac31c296f58cfdfa1684ac06b <ddf8029623a1af20e984c040e89ff918158397ab

Linux patch: 6.6.142

Linux ef5659280eb13e8ac31c296f58cfdfa1684ac06b <1861d369efd62d67796563bf3e01fc22e5626f8b

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE CRITICAL

Red Hat 7.0 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Jul 20, 2026 - 15:22 NVD

9.8 (CRITICAL)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:39 cve.org

CRITICAL 9.8

CVE Published

Jul 19, 2026 - 15:39 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bpf, skmsg: fix verdict sk_data_ready racing with ktls rx

sk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and defers to psock->saved_data_ready when a TLS RX context is present, avoiding a conflict with the TLS strparser's ownership of the receive queue (commit e91de6afa81c, "bpf: Fix running sk_skb program types with ktls").

sk_psock_verdict_data_ready() has no equivalent guard. When a socket is inserted into a sockmap (BPF_SK_SKB_VERDICT) before TLS RX is configured, tls_sw_strparser_arm() saves sk_psock_verdict_data_ready as rx_ctx->saved_data_ready. On data arrival:

tls_data_ready -> tls_strp_data_ready -> tls_rx_msg_ready -> saved_data_ready() = sk_psock_verdict_data_ready() -> tcp_read_skb() drains sk_receive_queue via __skb_unlink() without calling tcp_eat_skb(), so copied_seq is not advanced.

tls_strp_msg_load() then finds tcp_inq() >= full_len (stale), calls tcp_recv_skb() on the now-empty queue, hits WARN_ON_ONCE(!first), and returns with rx_ctx->strp.anchor.frag_list pointing at a psock-owned (potentially freed) skb. tls_decrypt_sg() subsequently walks that frag_list: use-after-free.

Apply the same fix as sk_psock_strp_data_ready(): if a TLS RX context is present, call psock->saved_data_ready (sock_def_readable) to wake recv() waiters and return immediately, leaving the receive queue untouched. TLS retains sole ownership of the queue and decrypts the record normally through tls_sw_recvmsg().

Executive ViewAI

Why It Matters

A critical kernel vulnerability (CVE-2026-64025, CVSS 9.8) in Linux BPF socket processing allows authenticated local users to escalate privileges or trigger denial of service. The vulnerability affects Linux systems with BPF and kernel TLS features enabled-a common configuration in modern cloud and containerized environments. Patching is critical to prevent both service disruptions and unauthorized system access.

Recommended Action

Within 24 hours, conduct an inventory of Linux systems running affected kernel versions, particularly those in cloud or containerized infrastructure with BPF and kernel TLS enabled. Within 7 days, obtain the security patch from your Linux distribution vendor, validate it in a staging environment matching your production stack, and create a deployment plan prioritizing high-risk systems. Within 30 days, deploy the kernel patch across all affected production systems through maintenance windows, testing system stability and network performance post-deployment to confirm successful remediation.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 94% exploitable

Data Quality

6 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).

Same weakness CWE-362 – Race Condition

View all

CVE-2023-36884 HIGH POC

7.5

CVE-2016-5195 HIGH POC

7.0

CVE-2017-1000112 HIGH POC

7.0

CVE-2014-0196 MEDIUM POC

5.5

CVE-2014-0226 MEDIUM POC

6.8

CVE-2016-1757 HIGH POC

7.0

CVE-2016-8655 HIGH POC

7.8

CVE-2025-39964 MEDIUM POC

5.5

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-64025 ADVISORY https://seclists.org/oss-sec/2026/q3/230 ADVISORY https://ubuntu.com/security/notices/USN-8593-1 ADVISORY https://vuldb.com/vuln/380185 REF https://git.kernel.org/stable/c/1861d369efd62d67796563bf3e01fc22e5626f8b REF https://git.kernel.org/stable/c/7c8cf21bc4efb4af18d6096db3f8bd06d622251c REF https://git.kernel.org/stable/c/8a52139560f833c3975032e1f5762611e3a36d71 REF https://git.kernel.org/stable/c/c9ea01768903ae47f210cd457af1dead6de7a9c3 REF https://git.kernel.org/stable/c/d698bdba0f9969a6e390d1b1a9a3e283f1f174a7 REF https://git.kernel.org/stable/c/ddf8029623a1af20e984c040e89ff918158397ab

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back