What is the CVSS score of CVE-2026-64111?

CVE-2026-64111 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-64111?

CVE-2026-64111 is a local privilege escalation vulnerability in the Linux kernel's security module infrastructure (LSM) on systems running SELinux or AppArmor, exploitable by unprivileged local users…. A patch is available.

How to fix or mitigate CVE-2026-64111?

Within 24 hours, inventory all Linux systems with SELinux or AppArmor enabled and prioritize those supporting critical or sensitive workloads for patching. Within 7 days, obtain the latest stable kernel versions containing the fix from your Linux vendor (Red Hat, Canonical, SUSE, etc.)-patch is already integrated into stable release branches-and plan a phased deployment schedule. Within 30 days, complete patching of all affected systems, validating system stability and security policy enforcement post-update before returning to production.

Linux Kernel CVE-2026-64111

EUVD-2026-45796 HIGH

2026-07-19 Linux

GHSA-rf37-4wvf-8h47

Information Disclosure Linux

7.1

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.3 MEDIUM

Local low-priv access (AV:L/PR:L) and reliance on winning a ptrace race window justify AC:H; a policy-transition bypass gives high confidentiality/integrity impact with no availability effect.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:29 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.1 (HIGH)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:40 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:40 cve.org

HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

lsm: hold cred_guard_mutex for lsm_set_self_attr()

Just as proc_pid_attr_write() already does before calling the LSM hook. This only matters for SELinux and AppArmor which check whether the process is being ptraced and if so, whether to allow the transition.

AnalysisAI

Local privilege/security-policy bypass in the Linux kernel's LSM (Linux Security Module) infrastructure arises because lsm_set_self_attr() failed to hold cred_guard_mutex before invoking the LSM hook, unlike the equivalent proc_pid_attr_write() path. On SELinux- or AppArmor-enforced systems, this allows a local low-privileged process to race the ptrace-based checks that gate a security-context transition, potentially performing a domain/type transition that policy would otherwise deny. EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis; the fix is already merged into stable kernels.

Technical ContextAI

The Linux Security Module (LSM) framework mediates security decisions for stackable modules such as SELinux and AppArmor. When a process sets its own security attribute (e.g., writing to /proc/self/attr/* or via the newer lsm_set_self_attr() syscall introduced with the LSM syscall API), SELinux and AppArmor must check whether the process is being ptraced and, if so, whether the requested context transition is permitted - this prevents a tracer from manipulating a tracee across a privilege boundary. That check is only race-free while cred_guard_mutex is held, which serializes credential changes against exec and ptrace attach. proc_pid_attr_write() already takes this mutex, but lsm_set_self_attr() did not, leaving a time-of-check/time-of-use window. Root cause is an improper-locking / race condition class flaw (CWE-362/CWE-667); the CWE field is unpopulated (N/A) in the source data. Affected component is the kernel's generic LSM syscall layer (security/lsm_syscalls.c / security.c).

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.12.92, 6.18.34, or 7.0.11 or later (fix also present in the 7.1 line) - via your distribution's kernel update channel, then reboot to load the patched kernel. The upstream fixes are available as stable commits: https://git.kernel.org/stable/c/82d3acee88593e3d9e71cad4b7d6b3cf70de9d07, https://git.kernel.org/stable/c/5b906f31e977286888a9e31282589b545b249139, https://git.kernel.org/stable/c/a010cadaf5727b8417f62fe9021fcef14a5f9b51, and https://git.kernel.org/stable/c/4a9b16541ad3faf8bccb398532bf3f8b6bbf1188. Where immediate kernel patching is not feasible, the practical compensating control is to constrain local access and ptrace: restrict untrusted local users, and set the yama LSM knob kernel.yama.ptrace_scope to 1 or higher to limit ptrace attachment (trade-off: may break legitimate debuggers, crash-handlers, and some sandboxing tooling). Because the exposure requires local low-privileged access, tightening who can run code on the host also reduces risk. Confirm your distro kernel package version rather than relying on the upstream tag alone.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64111 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64111

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code