What is the CVSS score of CVE-2026-64104?

CVE-2026-64104 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-64104?

CVE-2026-64104 affects the Linux kernel SEV-SNP guest driver, creating a memory encryption failure scenario that could expose data from confidential computing workloads.. A patch is available.

How to fix or mitigate CVE-2026-64104?

Within 24 hours: Identify and catalog all systems running Linux with SEV-SNP guest driver enabled, typically confidential computing workloads on AMD EPYC infrastructure. Within 7 days: Work with infrastructure and virtualization teams to schedule kernel updates and arrange maintenance windows for affected systems. Within 30 days: Apply vendor-released Linux kernel patches for CVE-2026-64104 across all affected systems, validate that memory encryption and decryption operations complete successfully post-patch, and monitor for related memory management anomalies.

Linux Kernel CVE-2026-64104

EUVD-2026-45789 HIGH

Memory Leak (CWE-401)

2026-07-19 Linux

GHSA-8rjp-wmfg-59v9

Information Disclosure Linux

8.7

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.7 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

vuln.today AI

4.7 MEDIUM

Local guest access (AV:L, PR:L) and dependence on a rare memory-transition failure (AC:H) yield only confidentiality impact (C:H) via residual plaintext; no clear integrity/availability effect.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:27 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

8.7 (HIGH)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:40 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:40 cve.org

HIGH 8.7

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

virt: sev-guest: Explicitly leak pages in unknown state

When set_memory_{encrypted,decrypted}() fail, the user cannot know at which point the function failed, meaning that the pages are left in an unknown state from the point of view of the caller.

Since the pages may be left in an unencrypted state, they are not suitable for general use, and cannot be returned safely to the buddy allocator. Avoid the issue by never freeing the pages, and then do the proper accounting by calling snp_leak_pages().

AnalysisAI

Information disclosure in the Linux kernel's SEV-SNP guest driver (virt/sev-guest) allows memory pages left in an indeterminate encryption state to be reclaimed by the buddy allocator, potentially exposing plaintext guest data to later allocations. When set_memory_encrypted()/set_memory_decrypted() fail partway, the caller cannot tell where they failed, so pages that may still be unencrypted were being freed for general reuse; the fix instead calls snp_leak_pages() to permanently retain them. Rated CVSS 8.7 (local, low-privilege); EPSS is low at 0.17% (7th percentile) with no public exploit identified at time of analysis and no CISA KEV listing.

Technical ContextAI

The affected code is the AMD SEV-SNP (Secure Encrypted Virtualization-Secure Nested Paging) guest support in the kernel's virt/coco/sev-guest path, which manages transitions of guest memory between encrypted (private) and shared (decrypted) states via set_memory_encrypted()/set_memory_decrypted(). These helpers walk page tables and issue PVALIDATE/page-state-change operations; if they fail mid-operation, the affected pages are left in an unknown state - possibly still marked shared/unencrypted. Returning such pages to the buddy allocator lets them be handed to unrelated kernel or userspace consumers while in an unexpected encryption state, a resource-cleanup defect (conceptually CWE-459 Incomplete Cleanup / CWE-226 Sensitive Information Uncleared Before Release; the feed lists CWE as N/A). The remedy deliberately 'leaks' the pages with snp_leak_pages() so they are accounted for and never reused.

RemediationAI

Patch available per vendor advisory: update to a Linux kernel that includes the fix, which landed in mainline 6.14 and was backported to stable trees via the commits referenced at git.kernel.org (https://git.kernel.org/stable/c/bee400ad4f4259c9c0758e4f1960a1eed6f6f9f0, https://git.kernel.org/stable/c/3d0cd0065deeb054b4b29236432e851806b7cc81, https://git.kernel.org/stable/c/fd948c3f96b18ff9ba7d3e8eae13d196593e1aaf); apply the fixed package from your distribution once it ships the relevant stable backport. Because exploitation requires running inside an AMD SEV-SNP guest and hitting a rare memory-state-transition failure, the pragmatic compensating control for unpatched systems is to limit exposure of the confidential-guest workload: restrict local/administrative access within the guest, avoid or reduce workloads that repeatedly toggle memory shared/private states, and monitor kernel logs for set_memory_encrypted/decrypted failures which precede the unsafe condition - noting these controls reduce, but do not eliminate, the underlying risk until the kernel is upgraded.

Same weakness CWE-401 – Memory Leak

View all

CVE-2020-13934 HIGH

7.5

CVE-2016-4232 HIGH POC

7.5

CVE-2024-25450 HIGH POC

8.8

CVE-2023-33718 HIGH POC

8.8

CVE-2019-6128 HIGH POC

8.8

CVE-2026-67183 HIGH POC

8.7

CVE-2023-34451 HIGH POC

8.2

CVE-2023-41484 HIGH POC

8.1

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64104 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64104

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-401 – Memory Leak

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code