What is the CVSS score of CVE-2026-64067?

CVE-2026-64067 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Linux CVE-2026-64067

EUVD-2026-45640 CRITICAL

Improper Locking (CWE-667)

2026-07-19 Linux

GHSA-f3mp-m5hm-h688

Information Disclosure Linux

Critical

Disputed · 9.8 Vendor: Linux

View

Vulnerability Assessment

Weakness

CWE

CWE-667

ASVS 5.0

V15 - Secure Coding and Architecture Proper locking

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 20, 2026

Memory-ordering defect in the Linux kernel's netfs (network filesystem helper) subsystem allows the lockless readers netfs_collect_read_results() and netfs_collect_write_results() to observe a subrequest pointer before the NETFS_SREQ_IN_PROGRESS flag and other subreq state are guaranteed visible, causing races on stream->subrequests. The flaw affects kernels from 6.10 onward that use netfs-backed filesystems (CIFS/SMB, AFS, Ceph, 9p) and can lead to stale-state reads, information disclosure, or instability during concurrent I/O collection. There is no public exploit identified at time of analysis, EPSS is very low (0.15%, 5th percentile), and it is not on CISA KEV; the upstream fix is available in stable git.

Affected VersionsENISA

Linux 288ace2f57c9d06dd2e42bd80d03747d879a4068 <b5782e2d462c028096f922abca46318cec890670

Linux patch: 0

Linux 288ace2f57c9d06dd2e42bd80d03747d879a4068 <293a4532c36f38458e38b8879b174ab797718b9d

Linux 6.10

Linux patch: 7.0.11

Linux patch: 7.1

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE 5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat 5.5 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Jul 20, 2026 - 15:22 NVD

9.8 (CRITICAL)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:39 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:39 cve.org

CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix missing barriers when accessing stream->subrequests locklessly

The list of subrequests attached to stream->subrequests is accessed without locks by netfs_collect_read_results() and netfs_collect_write_results(), and then they access subreq->flags without taking a barrier after getting the subreq pointer from the list. Relatedly, the functions that build the list don't use any sort of write barrier when constructing the list to make sure that the NETFS_SREQ_IN_PROGRESS flag is perceived to be set first if no lock is taken.

Fix this by:

(1) Add a new list_add_tail_release() function that uses a release barrier to set the pointer to the new member of the list.

(2) Add a new list_first_entry_or_null_acquire() function that uses an acquire barrier to read the pointer to the first member in a list (or return NULL).

(3) Use list_add_tail_release() when adding a subreq to ->subrequests.

(4) Use list_first_entry_or_null_acquire() when initially accessing the front of the list (when an item is removed, the pointer to the new front iterm is obtained under the same lock).

Executive ViewAI

Why It Matters

A critical memory-ordering flaw in Linux kernel 6.10+ affects network filesystems (CIFS/SMB, AFS, Ceph, 9p) that underpin enterprise storage and cloud infrastructure, potentially exposing sensitive data through concurrent I/O operations and causing service instability. Organizations relying on these filesystems for network-attached storage, hybrid cloud deployments, or enterprise file-sharing must remediate to prevent data disclosure incidents and maintain operational continuity.

Recommended Action

Within 24 hours: Identify all systems running Linux kernel 6.10 or later using CIFS/SMB, AFS, Ceph, or 9p filesystems through asset discovery and configuration review. Within 7 days: Test the available vendor patch in a non-production environment, prioritizing systems handling sensitive data or providing file-sharing services, and validate I/O stability post-patch. Within 30 days: Deploy patched kernel versions across all identified affected systems, monitoring filesystem operations and access logs to detect any anomalies.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 95% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-667 – Improper Locking

View all

CVE-2019-10072 HIGH

7.5

CVE-2025-43510 HIGH POC

7.8

CVE-2019-5886 CRITICAL POC

9.8

CVE-2020-13246 HIGH POC

7.5

CVE-2019-15513 HIGH POC

7.5

CVE-2019-11599 HIGH POC

7.0

CVE-2023-21400 MEDIUM POC

6.7

CVE-2021-20291 MEDIUM POC

6.5

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-64067 ADVISORY https://seclists.org/oss-sec/2026/q3/230 ADVISORY https://ubuntu.com/security/notices/USN-8593-1 ADVISORY https://vuldb.com/vuln/380207 REF https://git.kernel.org/stable/c/293a4532c36f38458e38b8879b174ab797718b9d REF https://git.kernel.org/stable/c/b5782e2d462c028096f922abca46318cec890670 REF https://git.kernel.org/stable/c/f048f297d93fdb19d72d01d22f04c419d8b16602

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back