What is the CVSS score of CVE-2026-64075?

CVE-2026-64075 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-64075?

A memory corruption vulnerability in the Linux kernel's function tracing subsystem could enable system crashes and service interruptions on affected Linux systems used for development, testing, and…. A patch is available.

How to fix or mitigate CVE-2026-64075?

Within 24 hours, identify which systems in your environment run Linux with kernel fprobe instrumentation enabled, typically in development, testing, and monitoring infrastructure. Within 7 days, source the patched kernel updates from your Linux distribution vendor and begin deployment to high-priority systems. Complete full deployment across all affected systems within 30 days, verifying kernel versions post-patch and monitoring for any stability changes.

Linux Kernel CVE-2026-64075

EUVD-2026-45648 HIGH

Use After Free (CWE-416)

2026-07-19 Linux

GHSA-q3rx-6vfg-rc7w

Linux Use After Free Memory Corruption Red Hat Suse

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local access with low privileges required to reach fprobe tracing interfaces; UAF enables full kernel memory corruption yielding C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

6.4 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 03, 2026 - 15:40 vuln.today

tag: Information Disclosure removed

Analysis Generated

Sep 03, 2026 - 14:53 vuln.today

CVSS changed

Sep 03, 2026 - 14:52 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:39 nvd

HIGH 7.8

CVE Published

Jul 19, 2026 - 15:39 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

fprobe: Fix unregister_fprobe() to wait for RCU grace period

Commit 4346ba1604093 ("fprobe: Rewrite fprobe on function-graph tracer") changed fprobe to register struct fprobe to an rcu-hlist, but it forgot to wait for RCU GP. Thus there can be use-after-free if the fprobe is released right after unregistering. This can be happened on fprobe event and sample module code.

To fix this issue, add synchronize_rcu() in unregister_fprobe().

Note that BPF is OK because fprobe is used as a part of bpf_kprobe_multi_link. This unregisters its fprobe in bpf_kprobe_multi_link_release() and it is deallocated via bpf_kprobe_multi_link_dealloc(), which is invoked from bpf_link_defer_dealloc_rcu_gp() RCU callback.

For BPF, this also introduced unregister_fprobe_async() which does NOT wait for RCU grace priod.

AnalysisAI

Use-after-free in the Linux kernel's fprobe subsystem exposes kernel memory to corruption when a fprobe is released immediately after unregistration without waiting for an RCU grace period. The flaw was introduced by commit 4346ba1604093, which rewrote fprobe on the function-graph tracer and placed struct fprobe on an RCU-protected hlist but omitted the required synchronize_rcu() call in unregister_fprobe(), leaving a window where in-flight RCU readers may dereference freed memory. BPF users of fprobe are explicitly unaffected because BPF defers deallocation through the bpf_link_defer_dealloc_rcu_gp() RCU callback; affected paths are fprobe events and sample module code.

Technical ContextAI

The fprobe subsystem provides kernel function entry and exit probing, layered on top of the function-graph tracer. Commit 4346ba1604093 refactored fprobe registration to use an RCU-protected hlist (a linked list safe for lockless concurrent readers via the Read-Copy-Update mechanism). RCU semantics require that after removing an element from such a list, the caller must wait for a grace period - during which all pre-existing RCU read-side critical sections complete - before freeing the element. The missing synchronize_rcu() in unregister_fprobe() violates this contract: if a caller frees the fprobe struct immediately after unregistering, any concurrent RCU reader that already holds a reference to it will dereference freed memory (CWE-416: Use After Free). The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the Linux kernel codebase broadly; affected versions span from commit 4346ba1604093 through the stable-tree fix commits.

RemediationAI

Upgrade to a patched Linux kernel release: version 7.1 or later on mainline, 7.0.11 or later on the 7.0.x stable branch (patch commit 56b4cfcf1518245493c60fd39c56978f508f1816 at https://git.kernel.org/stable/c/56b4cfcf1518245493c60fd39c56978f508f1816), or 6.18.34 or later on the 6.18.x stable branch (patch commit a4f6a9005ed6cfd360ef2520430927f05f92ffb0 at https://git.kernel.org/stable/c/a4f6a9005ed6cfd360ef2520430927f05f92ffb0). Ubuntu users should apply the packages referenced in USN-8593-1 at https://ubuntu.com/security/notices/USN-8593-1. As a compensating control on systems that cannot be immediately patched, restrict access to the kernel tracing and fprobe event interfaces (typically under /sys/kernel/debug/tracing/) to root only using DAC permissions or Linux Security Module policies such as SELinux or AppArmor; this prevents low-privileged local users from triggering the vulnerable unregister path. Note that this workaround does not protect against root-level exploitation and may break legitimate tracing tooling.

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2009-4324 HIGH POC

7.8

CVE-2015-0313 CRITICAL POC

9.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2013-2551 HIGH POC

8.8

Same technique Use After Free

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2009-4324 HIGH POC

7.8

CVE-2015-0313 CRITICAL POC

9.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2013-2551 HIGH POC

8.8

CVE-2012-4969 HIGH POC

8.1

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-64075 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64075

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-416 – Use After Free

Same technique Use After Free

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code