What is the CVSS score of CVE-2026-64066?

CVE-2026-64066 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-64066?

A critical vulnerability in the Linux kernel's storage subsystem could allow unauthorized disclosure of data from organizations using network-based or cached file storage solutions such as Ceph,…. A patch is available.

How to fix or mitigate CVE-2026-64066?

Within 24 hours, identify and catalog all systems and services using network or cached filesystems (including Ceph, SMB/CIFS, AFS, 9p, and fscache implementations) and prioritize based on sensitivity of stored data. Within 7 days, deploy vendor-released kernel patches to all affected systems, prioritizing production infrastructure first. Within 30 days, complete patching across all systems and validate through kernel version audits to ensure no affected versions remain in your environment.

Linux Kernel CVE-2026-64066

EUVD-2026-45639 CRITICAL

Out-of-bounds Read (CWE-125)

2026-07-19 Linux

GHSA-m28h-7php-jrhg

Buffer Overflow Information Disclosure Linux

Critical

Disputed · 9.8 Vendor: Linux

Severity by source

Sources disagree (Low–Critical)

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

3.6 LOW

Requires a local netfs-backed mount and an induced subrequest failure (AV:L/AC:H/PR:L); realistic impact is limited stale-data disclosure and possible read fault, so C:L/A:L and I:N.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:12 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

9.8 (CRITICAL)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:39 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:39 cve.org

CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix netfs_read_to_pagecache() to pause on subreq failure

Fix netfs_read_to_pagecache() so that it pauses the generation of new subrequests if an already-issued subrequest fails.

AnalysisAI

A missing back-pressure flaw in the Linux kernel's netfs read path (netfs_read_to_pagecache()) fails to pause generation of new read subrequests after an already-issued subrequest fails, affecting network/cached filesystems (e.g. AFS, Ceph, CIFS/SMB, 9p, and fscache-backed mounts) built on the netfs helper library. The upstream fix has been merged and backported to stable trees; EPSS is very low (0.17%, 6th percentile) and no public exploit or CISA KEV listing exists, so this is no public exploit identified at time of analysis. Despite an NVD/CNA CVSS of 9.8, the change is a reliability/correctness fix and the supplied tag characterizes real impact as Information Disclosure rather than remote code execution.

Technical ContextAI

netfs is the Linux kernel's shared network-filesystem helper library that manages reading folios into the page cache and coordinates with fscache/cachefiles; filesystems such as AFS, Ceph, CIFS/SMB3, 9p and NFS-adjacent cache paths delegate their read logic to it. netfs_read_to_pagecache() splits a read request into multiple subrequests that are issued to the underlying transport. The bug is a missing failure-handling/synchronization condition: when one issued subrequest fails, the loop does not pause issuing further subrequests, which can drive the request state machine into an inconsistent condition (premature continuation, potential use of not-yet-populated or partially-filled folios). CWE is unassigned by the CNA, but the class is best described as improper handling of exceptional/error conditions leading to incorrect read completion (uninitialized/stale page-cache data exposure per the Information Disclosure tag). The CPE data is generic (cpe:2.3:a:linux:linux:*) and does not pin exact versions; the commit ranges are the authoritative source.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - the fix is backported to 6.18.34, 7.0.11, and 7.1 (and the corresponding stable commits 884c4c4f35e5, 0256e79ce421, 8a8c0cfdf465); apply the build that matches your running series or take your distribution's next kernel update and reboot. Because the fix is a small netfs read-path correction, standard kernel patch-and-reboot is the correct and low-risk path. If you cannot patch immediately, the practical compensating control is to reduce reliance on netfs-backed filesystems on exposed hosts - for example avoid or unmount fscache/cachefiles-backed AFS, Ceph, or CIFS/SMB mounts where feasible, accepting the trade-off of losing local caching performance and that network share access is interrupted; there is no configuration toggle that disables the vulnerable code path without disabling the affected filesystems themselves. Track advisories via the kernel.org stable commits above and your distro's security tracker.

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

7.5

CVE-2016-5198 HIGH POC

8.8

CVE-2025-5777 CRITICAL POC

9.3

CVE-2016-1646 HIGH POC

8.8

CVE-2017-5030 HIGH POC

8.8

CVE-2016-4523 HIGH

7.5

CVE-2024-48456 HIGH POC

7.5

CVE-2024-48457 HIGH POC

7.5

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64066 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64066

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-125 – Out-of-bounds Read

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code