What is the CVSS score of CVE-2026-64062?

CVE-2026-64062 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64062?

Yes, a patch is available for CVE-2026-64062. Update the affected software to the latest version immediately.

Linux Kernel CVE-2026-64062

EUVD-2026-45635 MEDIUM

Improper Locking (CWE-667)

2026-07-19 Linux

GHSA-pw37-pjm5-88jp

Denial Of Service Linux Red Hat Suse

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local low-privilege user required; no confidentiality or integrity impact; deadlock produces full availability loss on affected kernel.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.5 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 02, 2026 - 21:40 vuln.today

tag: Information Disclosure replaced by Denial Of Service

Analysis Generated

Sep 02, 2026 - 21:23 vuln.today

CVSS changed

Sep 02, 2026 - 21:22 NVD

5.5 (MEDIUM)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:39 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:39 nvd

MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix potential deadlock in write-through mode

Fix netfs_advance_writethrough() to always unlock the supplied folio and to mark it dirty if it isn't yet written to the end. Unfortunately, it can't be marked for writeback until the folio is done with as that may cause a deadlock against mmapped reads and writes.

Even though it has been marked dirty, premature writeback can't occur as the caller is holding both inode->i_rwsem (which will prevent concurrent truncation, fallocation, DIO and other writes) and ictx->wb_lock (which will cause flushing to wait and writeback to skip or wait).

Note that this may be easier to deal with once the queuing of folios is split from the generation of subrequests.

AnalysisAI

Write-through mode deadlock in the Linux kernel netfs subsystem allows a local low-privileged user to hang the kernel, causing a denial of service. The defect in netfs_advance_writethrough() fails to unconditionally unlock a supplied folio, and prematurely marks it for writeback before the folio is fully written, creating a lock-ordering conflict against concurrent mmapped reads and writes. Patches are available across multiple stable kernel branches; no public exploit code or active exploitation has been identified.

Technical ContextAI

The netfs (Network Filesystem) abstraction layer in the Linux kernel, introduced to unify caching and I/O for network filesystems (e.g., NFS, Ceph, AFS), provides write-through mode for synchronous writeback. The vulnerability resides in netfs_advance_writethrough(), which manages folio lifecycle during write-through operations. CWE-667 (Improper Locking) describes the root cause: the function could fail to release a folio lock and prematurely trigger writeback on a folio, which conflicts with the page-fault path used by mmap'd I/O - that path also acquires per-folio and inode locks in a different order, creating a classic AB/BA deadlock. The affected CPE is cpe:2.3:a:linux:linux across versions from the introducing commit 288ace2f57c9 (around Linux 6.10) up to the stable fix commits.

RemediationAI

Update the Linux kernel to a patched stable release: 6.12.92, 7.0.11, or 7.1 as applicable to the deployed branch. Downstream distributions should apply USN-8593-1 (Ubuntu) or equivalent vendor security updates. The upstream fix commits are available at git.kernel.org/stable/c/1468f39243ccb155b6d97f9a9932f610d1205d75 and siblings for manual backporting. If immediate kernel update is not feasible and the system uses network filesystems with write-through mode, restricting local user access to filesystem write operations on the affected mounts reduces exposure until the patch is applied - though this may impact legitimate workloads. There are no known functional workarounds that eliminate the race without the fix.

Same weakness CWE-667 – Improper Locking

View all

CVE-2025-43510 HIGH POC

7.8

CVE-2019-5886 CRITICAL POC

9.8

CVE-2020-13246 HIGH POC

7.5

CVE-2019-15513 HIGH POC

7.5

CVE-2019-11599 HIGH POC

7.0

CVE-2023-21400 MEDIUM POC

6.7

CVE-2021-20291 MEDIUM POC

6.5

CVE-2026-53049 CRITICAL

9.8

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64062 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64062

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-667 – Improper Locking

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code