What is the CVSS score of CVE-2026-64061?

CVE-2026-64061 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-64061?

CVE-2026-64061 is a critical use-after-free vulnerability in the Linux kernel's network filesystem subsystem (CIFS/SMB client) that could permit local attackers to corrupt kernel memory and…. A patch is available.

How to fix or mitigate CVE-2026-64061?

Within 24 hours, identify all Linux systems running network filesystem mounts (CIFS/SMB) by querying asset inventory and executing 'mount | grep -i cifs' on suspected hosts, then determine affected kernel versions using 'uname -r' and cross-reference against vendor advisories. Within 7 days, apply the vendor-released kernel patch through your standard change management process-test in non-production first, schedule maintenance windows for system reboots, and coordinate with business units to minimize downtime on critical shared filesystems. Within 30 days, verify patch deployment completeness across all affected systems using configuration management tools, review system logs and kernel metrics (dmesg) for any KASAN warnings or memory corruption indicators, and document closure in your vulnerability tracking system.

Linux Kernel CVE-2026-64061

EUVD-2026-45634 CRITICAL

Use After Free (CWE-416)

2026-07-19 Linux

GHSA-89jm-xxxg-24xj

Information Disclosure Linux Use After Free Memory Corruption

9.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Triggered by local reads on a netfs mount (AV:L, PR:L) via a timing-dependent use-after-free race (AC:H); heap corruption can affect confidentiality, integrity, and availability (C/I/A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

7.0 HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:11 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

9.8 (CRITICAL)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:39 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:39 cve.org

CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix early put of sink folio in netfs_read_gaps()

Fix netfs_read_gaps() to release the sink page it uses after waiting for the request to complete. The way the sink page is used is that an ITER_BVEC-class iterator is created that has the gaps from the target folio at either end, but has the sink page tiled over the middle so that a single read op can fill in both gaps.

The bug was found by KASAN detecting a UAF on the generic/075 xfstest in the cifsd kernel thread that handles reception of data from the TCP socket:

BUG: KASAN: use-after-free in _copy_to_iter+0x48a/0xa20 Write of size 885 at addr ffff888107f92000 by task cifsd/1285 CPU: 2 UID: 0 PID: 1285 Comm: cifsd Not tainted 7.0.0 #6 PREEMPT(lazy) Call Trace: dump_stack_lvl+0x5d/0x80 print_report+0x17f/0x4f1 kasan_report+0x100/0x1e0 kasan_check_range+0x10f/0x1e0 __asan_memcpy+0x3c/0x60 _copy_to_iter+0x48a/0xa20 __skb_datagram_iter+0x2c9/0x430 skb_copy_datagram_iter+0x6e/0x160 tcp_recvmsg_locked+0xce0/0x1130 tcp_recvmsg+0xeb/0x300 inet_recvmsg+0xcf/0x3a0 sock_recvmsg+0xea/0x100 cifs_readv_from_socket+0x3a6/0x4d0 [cifs] cifs_read_iter_from_socket+0xdd/0x130 [cifs] cifs_readv_receive+0xaad/0xb10 [cifs] cifs_demultiplex_thread+0x1148/0x1740 [cifs] kthread+0x1cf/0x210

AnalysisAI

Use-after-free memory corruption in the Linux kernel's netfs subsystem (netfs_read_gaps()) allows local activity on network filesystem mounts (notably the cifs/SMB client) to write into a prematurely-freed sink folio. The bug arises because the sink page backing an ITER_BVEC iterator is released before the outstanding read op completes, letting the cifsd receive thread copy incoming socket data into freed memory - reproduced by KASAN on the generic/075 xfstest. There is no public exploit identified at time of analysis and EPSS risk is low (0.17%); the vendor-supplied CVSS of 9.8 (AV:N) appears inflated for what is fundamentally a local, race-dependent kernel flaw.

Technical ContextAI

The netfs framework is the kernel's generic network-filesystem read/write helper layer used by cifs (SMB), AFS, 9p, Ceph and similar. netfs_read_gaps() handles a partially-populated target folio by building an ITER_BVEC iterator that keeps the folio's existing head and tail bytes while tiling a single shared 'sink' page over the middle gap, so one read op can fill both gaps in a single I/O. The defect is a lifetime error: the sink page is put (reference released) before waiting for the read request to complete, so the buffer can be freed while the transport (here the cifsd kernel thread draining the TCP socket via _copy_to_iter/skb_copy_datagram_iter) is still writing received data into it. The root cause class is CWE-416 (Use After Free); the input lists CWE as N/A, so this classification is inferred from the KASAN report and patch description.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.12.92, 7.0.11, 6.18.34, or mainline 7.1 (or your distribution's backport containing stable commit 2a39d49c8d97df8cb8fa80c10859bc1ba7358c6b / d4f4bc87c76511cf2532448b0fa40c25e894bd7d / 412e8bad48967fd34295866636c028befd27d8b9 / 3e5dd91b87a8b1450217b56a336bee315f40da7d, referenced at https://git.kernel.org/stable/c/2a39d49c8d97df8cb8fa80c10859bc1ba7358c6b). Because the fix is a small lifetime correction in netfs_read_gaps(), patching is the clean solution and should be prioritized on hosts using SMB/cifs or other netfs mounts. Where immediate patching is not possible, the practical compensating control is to avoid exercising the vulnerable path: unmount or stop using cifs/AFS/9p/Ceph network filesystem mounts on affected kernels, or restrict which users and workloads can read from those mounts - the trade-off is loss of network-share functionality for those hosts. Generic host hardening does not neutralize the race.

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2009-4324 HIGH POC

7.8

CVE-2015-0313 CRITICAL POC

9.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2013-2551 HIGH POC

8.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64061 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64061

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-416 – Use After Free

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code