What is the CVSS score of CVE-2026-64122?

CVE-2026-64122 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-64122?

The NVIDIA/Mellanox ConnectX network driver (mlx5_core) used in cloud infrastructure and high-performance computing contains a critical kernel memory defect that can crash affected servers or expose…. A patch is available.

How to fix or mitigate CVE-2026-64122?

Within 24 hours, inventory all systems using Mellanox/NVIDIA mlx5 NICs and classify by criticality and recovery impact. Within 7 days, retrieve the vendor-released mlx5_core kernel driver patch and validate it in a non-production environment matching your production kernel version and network configuration. Within 30 days, deploy the patched driver across all affected systems according to your change control procedures, starting with critical production infrastructure.

Linux Kernel CVE-2026-64122

EUVD-2026-45807 CRITICAL

Use After Free (CWE-416)

2026-07-19 Linux

GHSA-q9qw-8fg7-ffww

Information Disclosure Linux Use After Free Memory Corruption

Critical

Disputed · 9.8 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.3 MEDIUM

Triggered via internal TX-timeout recovery on mlx5 hardware, so AV:L and AC:H for the race; some freed-memory read (C:L) but the dominant impact is a kernel crash (A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

7.0 CRITICAL

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

7.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:35 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

9.8 (CRITICAL)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:40 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:40 cve.org

CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover

mlx5e_tx_reporter_timeout_recover() accesses sq->netdev after mlx5e_safe_reopen_channels() has torn down and freed the channel (and its embedded SQs). Replace the three sq->netdev references with priv->netdev which is safe because priv outlives channel teardown.

The netdev_err() call already used priv->netdev for this reason; make the trylock/unlock and health_channel_eq_recover calls consistent.

This fixes the following KASAN splat:

BUG: KASAN: use-after-free in mlx5e_tx_reporter_timeout_recover+0x1dd/0x360 [mlx5_core] Read of size 8 at addr ffff889860ed0b28 by task kworker/u113:2/5277

Call Trace: mlx5e_tx_reporter_timeout_recover+0x1dd/0x360 [mlx5_core] devlink_health_reporter_recover+0xa2/0x150 devlink_health_report+0x254/0x7c0 mlx5e_reporter_tx_timeout+0x297/0x380 [mlx5_core] mlx5e_tx_timeout_work+0x109/0x170 [mlx5_core] process_one_work+0x677/0xf20 worker_thread+0x51f/0xd90 kthread+0x3a5/0x810 ret_from_fork+0x208/0x400 ret_from_fork_asm+0x1a/0x30

AnalysisAI

Kernel-memory use-after-free in the Linux mlx5e Ethernet driver (NVIDIA/Mellanox ConnectX mlx5_core) occurs when mlx5e_tx_reporter_timeout_recover() dereferences sq->netdev after mlx5e_safe_reopen_channels() has already freed the channel and its embedded send queues during TX-timeout health recovery. Systems using mlx5 NICs are affected; the freed-pointer read can corrupt kernel state, leak kernel memory, or crash the host. No public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not in CISA KEV, so this is a reliability/hardening fix rather than an actively exploited threat despite the NVD 9.8 score.

Technical ContextAI

The bug lives in the mlx5_core driver's devlink health reporter path for the mlx5e (ConnectX-family) Ethernet netdev. When a transmit timeout fires, mlx5e_tx_timeout_work schedules a devlink health report that invokes the reporter's recover callback, mlx5e_tx_reporter_timeout_recover(). That recovery calls mlx5e_safe_reopen_channels(), which tears down and frees the channel structure and the send queues (SQs) embedded in it. The function then continues to use stale sq->netdev references for its trylock/unlock and mlx5e_health_channel_eq_recover() calls, reading memory that has been freed - the classic root cause class CWE-416 (Use After Free). The fix replaces the three sq->netdev uses with priv->netdev, whose lifetime outlives channel teardown, matching the existing netdev_err() call that already used priv->netdev. CPE data identifies the affected component only as cpe:2.3:a:linux:linux, i.e. the mainline kernel tree.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.18.34 or later on the 6.18 series, 6.20 or later on the 6.19 series, and 7.0.11 on the 7.0 series - or apply the upstream fix commits (git.kernel.org 1604a2d6, 152295aa, 7d260c5d) that swap sq->netdev for priv->netdev in mlx5e_tx_reporter_timeout_recover(). Rebuild/reboot into the patched kernel through your distribution's kernel update channel. Because the flaw is only reachable via the mlx5e TX-timeout health-recovery path, an interim compensating control is to reduce TX-timeout-triggering conditions on mlx5 NICs (avoid known firmware/driver combinations that cause queue stalls) and monitor dmesg/KASAN for the mlx5e_tx_reporter_timeout_recover splat; note this only lowers trigger frequency and does not remove the bug. There is no supported configuration toggle that disables the devlink health reporter recovery for this driver without side effects, so kernel upgrade is the definitive fix.

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2009-4324 HIGH POC

7.8

CVE-2015-0313 CRITICAL POC

9.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2013-2551 HIGH POC

8.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64122 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64122

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-416 – Use After Free

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code