What is the CVSS score of CVE-2026-64048?

CVE-2026-64048 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-64048?

A remote denial of service vulnerability in Linux kernel SMC-D (Shared Memory Communications) allows attackers to crash affected systems during connection negotiation.. A patch is available.

How to fix or mitigate CVE-2026-64048?

Within 24 hours, identify and inventory all Linux systems with SMC-D enabled, prioritizing production infrastructure and high-availability services. Within 7 days, apply kernel security updates containing the SMC-D null-pointer dereference fix to non-critical systems and stage patches for production deployment. Complete patching of all affected systems within 30 days, coordinating with change management and communications teams to manage any service impacts.

Linux Kernel CVE-2026-64048

EUVD-2026-45621 HIGH

NULL Pointer Dereference (CWE-476)

2026-07-19 Linux

GHSA-942p-vjp4-xm8p

Denial Of Service Linux Null Pointer Dereference

7.5

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote malicious peer triggers a deterministic kernel null-deref crash with no auth or user interaction, yielding availability-only impact (A:H); no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:06 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.5 (HIGH)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:39 cve.org

HIGH 7.5

CVE Published

Jul 19, 2026 - 15:39 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot

On the SMC-D client, slot 0 of ini->ism_dev[]/ini->ism_chid[] is reserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt() populates V2 entries starting at index 1, so when no V1 device is selected slot 0 is left in its kzalloc()'ed state with ism_dev[0] NULL and ism_chid[0] 0.

smc_v2_determine_accepted_chid() then matches the peer's CHID against the array starting from index 0 using the CHID alone. A malicious peer replying to a SMC-Dv2-only proposal with d1.chid 0 matches the empty slot, ini->ism_selected becomes 0, and the subsequent ism_dev[0]->lgr_lock dereference in smc_conn_create() faults at offsetof(struct smcd_dev, lgr_lock) 0x68:

BUG: KASAN: null-ptr-deref in _raw_spin_lock_bh+0x79/0xe0 Write of size 4 at addr 0000000000000068 by task exploit/144 Call Trace: _raw_spin_lock_bh smc_conn_create (net/smc/smc_core.c:1997) __smc_connect (net/smc/af_smc.c:1447) smc_connect (net/smc/af_smc.c:1720) __sys_connect __x64_sys_connect do_syscall_64

Require ism_dev[i] to be non-NULL before accepting a CHID match.

AnalysisAI

Remote denial of service in the Linux kernel's SMC-D (Shared Memory Communications over ISM) client allows a malicious peer to crash the system via a null-pointer dereference during SMC-Dv2 connection setup. When a client sends an SMC-Dv2-only proposal and no SMC-Dv1 device is selected, a peer that replies with an ACCEPT containing CHID value 0 matches the reserved empty slot 0 of the ism_dev[] array, causing a null-ptr-deref on ism_dev[0]->lgr_lock in smc_conn_create(). No public exploit identified at time of analysis; EPSS is low (0.17%) and it is not listed in CISA KEV, but the fix is upstream in the kernel stable tree.

Technical ContextAI

The flaw is in the kernel's net/smc subsystem, which implements Shared Memory Communications (SMC) - an RDMA/ISM-accelerated alternative to TCP defined in RFC 7609. Specifically it involves SMC-D, the variant that runs over IBM z/Architecture Internal Shared Memory (ISM) devices identified by a CHID (Channel ID). During client-side device selection, slot 0 of ini->ism_dev[] and ini->ism_chid[] is reserved for an SMC-Dv1 device; smc_find_ism_v2_device_clnt() populates V2 candidates starting at index 1. When no V1 device is chosen, slot 0 remains in its kzalloc()'ed zero state (ism_dev[0]NULL, ism_chid[0]0). The root cause is a class CWE-476 (NULL Pointer Dereference) - smc_v2_determine_accepted_chid() compares the peer-supplied CHID against the array from index 0 using only the CHID, so a peer-supplied CHID of 0 matches the empty reserved slot; the resulting ism_selected=0 leads to dereferencing NULL at offsetof(struct smcd_dev, lgr_lock)==0x68, caught here by KASAN. CPE data identifies the affected product generically as cpe:2.3:a:linux:linux, i.e. the mainline/stable Linux kernel.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, or 7.1 (or later on your branch), which add the requirement that ism_dev[i] be non-NULL before accepting a CHID match; the corresponding upstream fix commits are available at git.kernel.org (e.g. https://git.kernel.org/stable/c/6927cacf2b10d4fa80c1a2d407512ef9397c59c6 and the sibling backports listed in the EUVD). Distribution users should apply the vendor kernel update rebased on these commits and reboot. Where immediate patching is not possible and SMC is not required, the most effective compensating control is to disable SMC - unload/blacklist the smc kernel module (modprobe blacklist smc) or avoid enabling AF_SMC sockets - which removes the vulnerable code path entirely at the cost of losing SMC/RDMA acceleration; alternatively, restrict SMC-D peering to trusted networks/partners so a malicious peer cannot send the crafted CHID-0 ACCEPT, accepting that this does not fix the underlying null-deref if any untrusted peer can be reached.

Same weakness CWE-476 – NULL Pointer Dereference

View all

CVE-2016-0742 HIGH

7.5

CVE-2014-3470 MEDIUM

4.3

CVE-2017-3730 HIGH POC

7.5

CVE-2017-3169 CRITICAL POC

9.8

CVE-2016-4957 HIGH

7.5

CVE-2015-3194 HIGH

7.5

CVE-2026-21525 MEDIUM

6.2

CVE-2017-0016 MEDIUM

5.9

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64048 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64048

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-476 – NULL Pointer Dereference

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code