What is the CVSS score of CVE-2026-64074?

CVE-2026-64074 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-64074?

CVE-2026-64074 affects the Linux kernel, allowing authenticated local users to exploit a file system memory corruption flaw that could enable privilege escalation on affected systems.. A patch is available.

How to fix or mitigate CVE-2026-64074?

Within 24 hours, conduct a complete inventory of Linux systems in your environment and identify which distributions and kernel versions are impacted by CVE-2026-64074; establish the scope of required patching across servers, workstations, and container infrastructure. Over the next 7 days, obtain the vendor-released patch from your Linux distribution and validate it in a staging environment to verify compatibility with your security stack and dependent applications before any production deployment. Within 30 days, deploy the patched kernel version to all affected Linux systems using your standard change management procedures, prioritizing internet-facing servers and systems with privileged access or sensitive data; execute post-patch scanning and logging to confirm successful remediation across the environment.

Linux Kernel CVE-2026-64074

EUVD-2026-45647 HIGH

Out-of-bounds Write (CWE-787)

2026-07-19 Linux

GHSA-q6fc-4c58-35pf

Buffer Overflow Linux Memory Corruption

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

4.4 MEDIUM

Local low-priv syscall access (AV:L/PR:L); the primitive is a single NULL out-of-bounds byte, so realistic impact is limited integrity/availability (I:L/A:L), no direct disclosure (C:N).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:14 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:39 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:39 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap

statmount_mnt_idmap() writes one mapping with seq_printf() and then manually advances seq->count to include the NUL separator.

If seq_printf() overflows, seq_set_overflow() sets seq->count to seq->size. The manual seq->count++ changes this to seq->size + 1. seq_has_overflowed() then no longer detects the overflow. The corrupted count returns to statmount_string(), which later executes:

seq->buf[seq->count++] = '\0';

This causes a 1-byte NULL out-of-bounds write on the dynamically allocated seq buffer.

Fix this by checking for overflow immediately after seq_printf().

AnalysisAI

Local privilege-adjacent memory corruption in the Linux kernel's fs/statmount subsystem allows an authenticated local user to trigger a 1-byte NULL out-of-bounds write on a dynamically allocated seq buffer. The flaw lives in statmount_mnt_idmap(), which manually advances seq->count after seq_printf(); on overflow this desynchronizes the buffer accounting so seq_has_overflowed() misses the overflow and a later 'seq->buf[seq->count++] = 0' writes past the slab allocation. Rated CVSS 7.8 (High); EPSS is low (0.17%, 6th percentile), no public exploit or CISA KEV listing exists at time of analysis, and a vendor fix is available.

Technical ContextAI

The bug is in the statmount(2) syscall path (fs/statmount.c), a relatively new mount-introspection interface that reports mount properties including idmap information via the kernel's seq_file buffer machinery. statmount_mnt_idmap() emits one ID mapping with seq_printf() and then manually does seq->count++ to append a NUL separator. When seq_printf() overflows the buffer, seq_set_overflow() sets seq->count to seq->size; the manual increment pushes it to seq->size + 1, which defeats seq_has_overflowed() (it checks count == size). The corrupted count propagates back to statmount_string(), which performs seq->buf[seq->count++] = '\0', writing one NULL byte one position past the end of the slab-allocated seq buffer. Root-cause class is an out-of-bounds write / buffer overflow (CWE-787) arising from improper overflow-state validation of the seq_file counter; the vendor tagged it 'Buffer Overflow' though upstream provided no formal CWE.

RemediationAI

Patch available per vendor advisory: apply the upstream kernel fix that checks for overflow immediately after seq_printf() in statmount_mnt_idmap(), delivered via the stable-tree commits e37ea2c6f17f273813ea4e8e94c102591d598ce1, 93614949dc86f068e3c32c32cf1ee2a2323177a7, and a3bf0f28d4ba16e1f35f8c983bb04426b87e2a78 (https://git.kernel.org/stable/c/e37ea2c6f17f273813ea4e8e94c102591d598ce1 and the two companion links), with a stable release around 6.18.34. The practical action is to update to your distribution's patched kernel package and reboot; because the fix version is branch-dependent, confirm the specific patched build with your distro's security tracker rather than trusting a single upstream tag. If immediate patching is not possible, the primary compensating control is to limit untrusted local code execution on the host - restrict shell/local accounts and container escape surface - since exploitation requires local access; note there is no supported runtime toggle to disable statmount specifically, so mitigation is limited to reducing who can run local code, which does not eliminate the flaw for legitimate local users.

Same weakness CWE-787 – Out-of-bounds Write

View all

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2012-1889 HIGH POC

8.8

CVE-2010-3333 HIGH POC

7.8

CVE-2014-1761 HIGH POC

7.8

CVE-2009-3129 HIGH POC

7.8

CVE-2021-1732 HIGH POC

7.8

CVE-2013-3346 CRITICAL POC

9.8

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64074 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64074

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-787 – Out-of-bounds Write

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code