What is the CVSS score of CVE-2026-64068?

CVE-2026-64068 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-64068?

CVE-2026-64068 is a critical memory corruption vulnerability in the Linux kernel's netfs library that affects organizations relying on network filesystems (AFS, Ceph, CIFS/SMB, 9p).. A patch is available.

How to fix or mitigate CVE-2026-64068?

Within 24 hours, identify all Linux systems running kernel versions 6.10 and later that utilize netfs-backed network filesystems and prioritize affected infrastructure for patching. Within 7 days, obtain the vendor-released patch for your Linux distribution, test it thoroughly in a non-production environment that mirrors your affected infrastructure, and develop a staged deployment plan coordinated with network filesystem usage patterns. Within 30 days, deploy the patch to all production systems using netfs, rolling out in phases to maintain service availability.

Linux Kernel CVE-2026-64068

EUVD-2026-45641 CRITICAL

Improper Locking (CWE-667)

2026-07-19 Linux

GHSA-8vm6-jvf8-6w38

Information Disclosure Linux

Critical

Disputed · 9.8 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.3 MEDIUM

Internal kernel retry-path race needs local access and precise timing (AV:L, AC:H, PR:L); most likely a crash (A:H) with possible minor memory disclosure (C:L), not integrity compromise.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

4.7 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:13 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

9.8 (CRITICAL)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:39 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:39 cve.org

CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix missing locking around retry adding new subreqs

Fix netfs_retry_read_subrequests() and netfs_retry_write_stream() to take the appropriate lock when adding extra subrequests into stream->subrequests.

AnalysisAI

Memory corruption in the Linux kernel's netfs library (introduced around v6.10) arises because netfs_retry_read_subrequests() and netfs_retry_write_stream() add new subrequests to stream->subrequests without holding the stream lock, creating a race on the shared list during I/O retry. The flaw affects systems using netfs-backed network filesystems (e.g. AFS, Ceph, CIFS/SMB, 9p) and can lead to list corruption, information disclosure, or a crash when concurrent retries mutate the list. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.15%), consistent with a hard-to-trigger local kernel race rather than a remotely weaponizable bug.

Technical ContextAI

netfs is the Linux kernel's shared network-filesystem I/O helper layer that batches page-cache reads and writes into 'subrequests' grouped under a stream object; when a subrequest fails, the retry paths (netfs_retry_read_subrequests and netfs_retry_write_stream) split or re-issue work by inserting additional subrequests into stream->subrequests. The root cause is an improper-locking / race condition (CWE-667 / CWE-362): these insertions occurred without taking the lock that otherwise guards the subrequest list, so a concurrent walker or completion handler can observe or manipulate the list mid-modification. The affected CPE is cpe:2.3:a:linux:linux (the mainline kernel), specifically the fs/netfs retry code present from roughly v6.10 up to the fixed stable releases. The CWE was not supplied by NVD, but the described fix - 'take the appropriate lock when adding extra subrequests' - clearly places this in the concurrency-control defect class.

RemediationAI

Vendor-released patch: update to Linux kernel 7.0.11 or 7.1 (or the equivalent patched build shipped by your distribution), which apply commits 393f3f0d7353a94b1e0bc4ca89c683fe983e5fd2 and cce18c263e9623872327ba3c956012f73c1179cc to take the stream lock before adding retry subrequests; the fixes are documented at https://git.kernel.org/stable/c/393f3f0d7353a94b1e0bc4ca89c683fe983e5fd2 and https://git.kernel.org/stable/c/cce18c263e9623872327ba3c956012f73c1179cc and cross-referenced at https://nvd.nist.gov/vuln/detail/CVE-2026-64068. If immediate patching is not possible, the practical compensating control is to avoid the vulnerable code path by not mounting netfs-backed network filesystems (AFS, Ceph, CIFS/SMB, 9p) on exposed hosts, since the bug only manifests on I/O retries through that layer - the trade-off is loss of those filesystem capabilities. Restricting local access and reducing untrusted local workloads lowers the chance of an attacker forcing the concurrent-retry race, though these are partial mitigations only.

Same weakness CWE-667 – Improper Locking

View all

CVE-2025-43510 HIGH POC

7.8

CVE-2019-5886 CRITICAL POC

9.8

CVE-2020-13246 HIGH POC

7.5

CVE-2019-15513 HIGH POC

7.5

CVE-2019-11599 HIGH POC

7.0

CVE-2023-21400 MEDIUM POC

6.7

CVE-2021-20291 MEDIUM POC

6.5

CVE-2026-53049 CRITICAL

9.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64068 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64068

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-667 – Improper Locking

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code