What is the CVSS score of CVE-2026-64072?

CVE-2026-64072 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64072?

Yes, a patch is available for CVE-2026-64072. Update the affected software to the latest version immediately.

Linux Kernel CVE-2026-64072

EUVD-2026-45645 MEDIUM

Memory Leak (CWE-401)

2026-07-19 Linux

GHSA-wmrv-hj8c-hqrm

Denial Of Service Linux Red Hat Suse

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local memory leak triggered by low-privileged NVMe I/O; no confidentiality or integrity impact, only gradual availability loss via kernel memory exhaustion.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.5 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 03, 2026 - 15:40 vuln.today

tag: Information Disclosure replaced by Denial Of Service

Analysis Generated

Sep 03, 2026 - 14:53 vuln.today

CVSS changed

Sep 03, 2026 - 14:52 NVD

5.5 (MEDIUM)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:39 nvd

MEDIUM 5.5

CVE Published

Jul 19, 2026 - 15:39 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

nvme: fix bio leak on mapping failure

The local bio is always NULL, so we'd leak the bio if the integrity mapping failed. Just get it directly from the request.

AnalysisAI

Bio memory leak in the Linux kernel NVMe driver causes kernel memory exhaustion under integrity-mapping failure conditions, affecting local low-privileged users on systems with NVMe integrity features enabled. The defect lies in the NVMe block-I/O path: a local bio pointer is always NULL, so when integrity mapping fails the associated bio object is never freed - the fix retrieves the bio directly from the request structure. With EPSS at 0.17% (7th percentile) and no CISA KEV listing, no public exploit has been identified at time of analysis, and real-world risk is confined to gradual memory exhaustion rather than immediate system compromise.

Technical ContextAI

NVMe (Non-Volatile Memory Express) manages block I/O in the Linux kernel through bio (block I/O descriptor) structures, which must be explicitly allocated and freed along each I/O path. CWE-401 (Missing Release of Memory after Effective Lifetime) applies: in the integrity-mapping failure path, the code attempts to free a local bio variable that is always NULL rather than the bio attached to the request object, causing a resource leak on every failure. The root cause is a mismatched pointer reference - the local variable is never assigned, so the actual bio from the request is silently dropped without being freed. Affected CPE: cpe:2.3:a:linux:linux:*. Upstream commits fea4b46f84c5, 51ec7fc4e10c, and 2279cd9c61a3 correct the pointer to source the bio from the request structure directly.

RemediationAI

Upgrade to a patched kernel: Linux 6.18.34, 7.0.11, or 7.1. Upstream fix commits are available at https://git.kernel.org/stable/c/fea4b46f84c50caf93c6c0f2a54b1be2edfb4491, https://git.kernel.org/stable/c/51ec7fc4e10c5e332bf4007bdb7e4c6bf03c14c9, and https://git.kernel.org/stable/c/2279cd9c61a330e5de4d6eb0bc422820dd6fdf36. Ubuntu users should apply USN-8593-1. As a compensating control on systems where immediate patching is not feasible, disabling NVMe T10 PI/DIF integrity metadata removes the failure path that triggers the leak - note that this disables storage data-integrity validation and may violate compliance requirements for environments that mandate it; verify application tolerance before making this change.

Same weakness CWE-401 – Memory Leak

View all

CVE-2020-13934 HIGH

7.5

CVE-2016-4232 HIGH POC

7.5

CVE-2024-25450 HIGH POC

8.8

CVE-2023-33718 HIGH POC

8.8

CVE-2019-6128 HIGH POC

8.8

CVE-2026-67183 HIGH POC

8.7

CVE-2023-34451 HIGH POC

8.2

CVE-2023-41484 HIGH POC

8.1

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-64072 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64072

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-401 – Memory Leak

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code