What is the CVSS score of CVE-2026-64049?

CVE-2026-64049 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64049?

Yes, a patch is available for CVE-2026-64049. Update the affected software to the latest version immediately.

Linux Kernel CVE-2026-64049

EUVD-2026-45622 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-07-19 Linux

GHSA-x7cr-4cjx-m6cx

Denial Of Service Linux Null Pointer Dereference Red Hat Suse

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local low-privilege user triggers kernel crash via DRM ioctl on specific GPU hardware; no confidentiality or integrity impact applies.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 02, 2026 - 23:31 vuln.today

CVSS changed

Sep 02, 2026 - 21:22 NVD

5.5 (MEDIUM)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:39 nvd

MEDIUM 5.5

CVE Published

Jul 19, 2026 - 15:39 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx

Before a5xx Adreno driver will not try fetching UBWC params (because those generations didn't support UBWC anyway), however it's still possible to query UBWC-related params from the userspace, triggering possible NULL pointer dereference. Check for UBWC config in adreno_get_param() and return sane defaults if there is none.

Patchwork: https://patchwork.freedesktop.org/patch/717778/

AnalysisAI

NULL pointer dereference in the Linux kernel's drm/msm/adreno driver allows local low-privilege users to crash systems equipped with older Qualcomm Adreno GPU generations (a2xx through a4xx). Querying UBWC (Universal Bandwidth Compression) parameters from userspace on these GPU families - which have no UBWC support and therefore no initialized UBWC config structure - triggers a NULL dereference in adreno_get_param(), resulting in a kernel panic. No public exploit has been identified at time of analysis; EPSS is 0.17% (6th percentile), consistent with the hardware-specific, local-only scope.

Technical ContextAI

The MSM DRM subsystem in the Linux kernel exposes GPU parameter queries to userspace via the adreno_get_param() function. Qualcomm Adreno GPU generations a2xx through a4xx predate UBWC (Universal Bandwidth Compression), so the UBWC configuration structure is never allocated for these hardware families. The bug arises because the DRM ioctl interface does not gate UBWC parameter queries to hardware that supports them - any local process can query these params regardless of the underlying GPU generation. Without the null-check introduced by the fix, the driver dereferences the uninitialized pointer (CWE-476), immediately faulting the kernel. The vulnerable code path is in drivers/gpu/drm/msm/adreno. a5xx and later generations initialize UBWC config and are not affected.

RemediationAI

Update the Linux kernel to a patched stable release: 7.0.11, 7.1, or 6.18.34. The three upstream fix commits are available at https://git.kernel.org/stable/c/eea43d5ed45089705bc5d70971c39076962d5951, https://git.kernel.org/stable/c/22fc33d9b67694b24e0deb3f08c622464338cecb, and https://git.kernel.org/stable/c/2b4abf879360ea00a9e2b46d2d15dcdbc0687eed. Ubuntu users should apply USN-8593-1 through standard package management. If an immediate kernel upgrade is not feasible on systems with a2xx-a4xx Adreno hardware, restricting access to the DRM device node (typically /dev/dri/card* and /dev/dri/renderD*) to trusted users only via udev rules or file permissions reduces the attack surface, though this will prevent any unprivileged GPU access by legitimate applications.

Same weakness CWE-476 – NULL Pointer Dereference

View all

CVE-2016-0742 HIGH

7.5

CVE-2014-3470 MEDIUM

4.3

CVE-2017-3730 HIGH POC

7.5

CVE-2017-3169 CRITICAL POC

9.8

CVE-2016-4957 HIGH

7.5

CVE-2015-3194 HIGH

7.5

CVE-2026-21525 MEDIUM

6.2

CVE-2017-0016 MEDIUM

5.9

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-64049 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64049

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-476 – NULL Pointer Dereference

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code