What is the CVSS score of CVE-2026-64039?

CVE-2026-64039 has a contested CVSS base score of 7.7 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-64039?

Organizations operating Linux systems with specific display hardware face confidentiality and availability risks from a kernel vulnerability that allows unprivileged local users to access protected…. A patch is available.

How to fix or mitigate CVE-2026-64039?

Within 24 hours, cross-reference your Linux kernel versions against the CVE-2026-64039 vendor advisory to identify systems running the drm/msm display subsystem. Within 7 days, obtain the patched kernel version from your distribution vendor and test it in a non-production environment to ensure compatibility with display and graphics functionality. Within 30 days, deploy the patched kernel to all affected production systems, prioritizing those supporting critical or user-facing services, and verify deployment success through kernel version compliance checks.

Linux Kernel CVE-2026-64039

EUVD-2026-45612 HIGH

2026-07-19 Linux

GHSA-3hrp-9734-8xmp

Information Disclosure Linux

High

Disputed · 7.7 Vendor: Linux

Severity by source

Sources disagree (Low–High)

Vendor (Linux) PRIMARY

7.7 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

7.1 HIGH

Local debug/dump path typically gated behind devcoredump/debugfs access, so PR:L rather than PR:N; out-of-bounds read gives C:H and overallocation gives A:H, no integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:02 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.7 (HIGH)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:39 cve.org

HIGH 7.7

CVE Published

Jul 19, 2026 - 15:39 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/snapshot: fix dumping of the unaligned regions

The snapshotting code internally aligns data segment to 16 bytes. This works fine for DPU code (where most of the regions are aligned), but fails for snapshotting of the DSI data (because DSI data region is shifted by 4 bytes). Fix the code by removing length alignment and by accurately printing last registers in the region. While reworking the code also fix the 16x memory overallocation in msm_disp_state_dump_regs().

Patchwork: https://patchwork.freedesktop.org/patch/725449/

AnalysisAI

Information disclosure and denial-of-service in the Linux kernel's drm/msm display snapshot subsystem allows a local low-privileged user to read out-of-bounds register data and trigger a 16x memory overallocation during device state dumps. The flaw stems from the snapshot code force-aligning data segments to 16 bytes, which mishandles unaligned regions such as the 4-byte-shifted DSI data, causing inaccurate register reads. No public exploit identified at time of analysis; EPSS probability is low (0.21%), and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the Qualcomm MSM/Adreno DRM display driver (drm/msm), specifically its GPU/display state snapshotting path in msm_disp_state_dump_regs(). This code captures register regions from the DPU (Display Processing Unit) and DSI (Display Serial Interface) blocks into a crash/debug snapshot. The bug is a length-alignment error: the snapshot routine internally rounds each data segment up to 16 bytes, which coincidentally matches most DPU regions but breaks for DSI regions whose data start is offset by 4 bytes, resulting in incorrect handling of the final registers in a region. A secondary defect is a 16x memory overallocation in the same function. No CWE was assigned by NVD, but the behavior falls into out-of-bounds read / improper memory sizing classes (CWE-125 / CWE-131), consistent with the vendor 'Information Disclosure' tag.

RemediationAI

Vendor-released patch: update to a fixed stable kernel for your branch - 6.1.175, 6.6.142, 6.12.92, 5.15.209, 6.18.34, 7.0.11, or 7.1 or later (apply the version matching your maintained series). The upstream fixes are available as stable commits on git.kernel.org (see references such as https://git.kernel.org/stable/c/cecd34e046121d788a70b5c8b4f8a88916637953). Because the bug lives in the drm/msm snapshot/dump path, an effective compensating control where immediate patching is not possible is to restrict access to the kernel crash/coredump interface: disable or tighten devcoredump collection and restrict debugfs (mount with restrictive permissions or set kernel.debugfs access to root-only), which prevents unprivileged triggering of the state dump at the cost of losing display-driver debug telemetry. On platforms that do not use Qualcomm/MSM display hardware, ensure CONFIG_DRM_MSM is not enabled, which removes exposure entirely.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64039 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64039

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code