What is the CVSS score of CVE-2026-64042?

CVE-2026-64042 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-64042?

A resource validation flaw in Linux kernel VFIO/PCI implementation could allow local users with VFIO device file access to circumvent memory protections and read data from adjacent devices.. A patch is available.

How to fix or mitigate CVE-2026-64042?

Within 24 hours, inventory Linux systems where VFIO/PCI device passthrough is enabled or in use. Within 7 days, deploy the available kernel patch across affected systems during maintenance windows, prioritizing production virtualization hosts and platforms supporting device assignment to containers. Complete deployment and testing of device passthrough functionality within 30 days.

Linux Kernel CVE-2026-64042

EUVD-2026-45615 HIGH

2026-07-19 Linux

GHSA-h9jg-4972-qw48

Information Disclosure Linux

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.9 HIGH

Local VFIO access is required (AV:L, PR:L), no interaction (UI:N); primary impact is disclosure of adjacent device MMIO (C:H, S:C), with only limited integrity/availability effect (I:L/A:L) versus the vendor's I:H/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.0 HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:04 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

8.8 (HIGH)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:39 cve.org

HIGH 8.8

CVE Published

Jul 19, 2026 - 15:39 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

vfio/pci: Check BAR resources before exporting a DMABUF

A DMABUF exports access to BAR resources and, although they are requested at startup time, we need to ensure they really were reserved before exporting. Otherwise, it's possible to access unreserved resources through the export.

Add a check to the DMABUF-creation path.

AnalysisAI

Improper resource validation in the Linux kernel's vfio/pci DMABUF export path (vfio/pci) allows a local user holding a VFIO device file descriptor to export and access PCI BAR (MMIO) resources that were never successfully reserved, enabling disclosure of adjacent device memory. The flaw stems from the DMABUF-creation path exporting BAR access without first confirming the resources were reserved at startup. There is no public exploit identified at time of analysis, EPSS is low (0.19%), and it is not listed in CISA KEV; the fix has been merged upstream.

Technical ContextAI

The affected component is VFIO (Virtual Function I/O), the Linux kernel framework used to pass PCI devices directly through to userspace or virtual machines. A recently added capability lets VFIO export a device's BAR (Base Address Register) memory regions as a DMABUF so they can be shared for peer-to-peer DMA between devices. BAR resources are normally 'requested'/reserved at device probe time; the bug is a missing precondition check - the DMABUF export path did not verify the BAR region was actually reserved before handing out access to it, so a caller could obtain a DMABUF pointing at unreserved MMIO. CWE is unassigned by NVD, but the root cause class is improper validation of a resource's state prior to use (missing check before privileged operation), adjacent to CWE-459/CWE-667-style resource-handling errors. Per the CPE data the affected product is cpe:2.3:a:linux:linux, i.e. the mainline Linux kernel; the code path only exists in very recent kernels (fix referenced against 6.19 and 7.x stable branches).

RemediationAI

Patch available per vendor advisory: apply the stable kernel updates containing the fix (commits 8443cd4497a4498c4b01058d76a92116244cb605 and 702809dabdecca807bdd50cfdcc1c980feb2ba62, referenced against the 7.0.11/7.1 stable tags and 6.19) via https://git.kernel.org/stable/c/8443cd4497a4498c4b01058d76a92116244cb605 and https://git.kernel.org/stable/c/702809dabdecca807bdd50cfdcc1c980feb2ba62, then reboot into the patched kernel. Because the exploit path is only reachable through VFIO device access, the most effective compensating control until you can reboot is to restrict who can open VFIO device nodes - tighten permissions/ownership on /dev/vfio/* and limit membership of groups granted device passthrough, which prevents unprivileged local users from reaching the DMABUF export path at the cost of blocking legitimate userspace/VM passthrough for those users. Where BAR-based DMABUF/peer-to-peer DMA export is not required, avoid enabling it; the trade-off is loss of P2P DMA sharing for workloads that depend on it. Do not rely on generic hardening alone - the concrete control is constraining VFIO device access.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64042 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64042

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code