What is the CVSS score of CVE-2026-64050?

CVE-2026-64050 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-64050?

A memory vulnerability in the Linux kernel's display driver for Qualcomm-based systems (CVE-2026-64050, CVSS 7.8) allows local users to crash the display system or potentially escalate privileges.. A patch is available.

How to fix or mitigate CVE-2026-64050?

Within 24 hours, identify all systems running Linux kernels with Qualcomm MSM Display Processing Unit support and audit current kernel versions in your inventory. Within 7 days, coordinate with your Linux distribution vendor to obtain the patched kernel version and deploy to test environments to verify display functionality remains stable. Complete full fleet deployment of the kernel update within 30 days, prioritizing systems where untrusted local users have shell access.

Linux Kernel CVE-2026-64050

EUVD-2026-45623 HIGH

Use After Free (CWE-416)

2026-07-19 Linux

GHSA-9858-6444-xrjw

Information Disclosure Linux Use After Free Memory Corruption

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local DRM-device access gives PR:L and AV:L; the flaw hinges on a teardown/reference race so AC:H, and a kernel UAF yields full C:H/I:H/A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:07 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:39 cve.org

HIGH 7.8

CVE Published

Jul 19, 2026 - 15:39 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/dpu: don't mix devm and drmm functions

Mixing devm and drmm functions will result in a use-after-free on msm driver teardown if userspace keeps a reference on the drm device: The WB connector data will be destroyed because of the use of devm_kzalloc()), while the usersoace still can try interacting with the WB connector (which uses drmm_ functions).

Change dpu_writeback_init() to use drmm_.

Patchwork: https://patchwork.freedesktop.org/patch/722656/

AnalysisAI

Use-after-free in the Linux kernel's Qualcomm MSM Display Processing Unit (DPU) DRM driver arises because dpu_writeback_init() mixes device-managed (devm_) and DRM-managed (drmm_) allocation lifetimes. On driver teardown, the writeback connector's data is freed via devm while userspace still holds a reference to the drm device and can interact with the drmm-backed connector, creating a dangling pointer a local user can exploit. Rated CVSS 7.8 (local, low-privilege); EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis.

Technical ContextAI

The affected component is the DRM/KMS subsystem of the Linux kernel, specifically the msm driver that powers Qualcomm Snapdragon/Adreno display hardware and its writeback (WB) connector path. The Linux DRM core offers two resource-lifetime models: devm_ (tied to the underlying struct device lifetime) and drmm_ (tied to the struct drm_device lifetime, released only when the last userspace reference drops). When dpu_writeback_init() allocates connector state with devm_kzalloc() but the connector itself is managed by drmm_ functions, the two lifetimes diverge. This is a classic use-after-free (CWE-416): the object is reclaimed on one lifetime boundary while still reachable through the other. The fix converts dpu_writeback_init() to use drmm_ allocation so both share the drm_device lifetime.

RemediationAI

Vendor-released patch: update to a fixed Linux kernel - 6.18.34, 7.0.11, or 7.1 (or later) - or apply the upstream stable commits ff58e5ef1b46ce614af048d2d04986df05ffab90, 95048a12f48c627bc2ccc4d84f87640630ba2bdb, and c0c70a11365cba7fba25a77463582bcec0f7846e from git.kernel.org/stable, which change dpu_writeback_init() to use drmm_ allocation. Most users should consume the fix through their distribution's kernel update rather than hand-patching. As a compensating control where patching must be delayed, restrict access to the DRM render/card device nodes (/dev/dri/*) via permissions or seccomp/cgroup device policy so untrusted local users cannot hold references across driver teardown, and avoid dynamically unbinding/rebinding the msm display driver on affected systems; the trade-off is reduced graphics access for unprivileged processes and loss of hot driver reload. Verify against your vendor kernel advisory before deployment.

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2009-4324 HIGH POC

7.8

CVE-2015-0313 CRITICAL POC

9.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2013-2551 HIGH POC

8.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64050 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64050

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-416 – Use After Free

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code