Skip to main content

Linux Kernel CVE-2026-64147

| EUVDEUVD-2026-45832 MEDIUM
Memory Leak (CWE-401)
2026-07-19 Linux GHSA-w83r-v6f6-jq46
Denial Of Service Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local driver exploit requiring shell access and Pensando DPU hardware; no confidentiality or integrity impact, availability impact from crash or memory exhaustion.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 19:53 vuln.today
CVSS changed
Aug 17, 2026 - 19:52 NVD
5.5 (MEDIUM)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:40 nvd
MEDIUM 5.5
CVE Published
Jul 19, 2026 - 15:40 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

pds_core: fix debugfs_lookup dentry leak and error handling

debugfs_lookup() returns a dentry with an elevated reference count that must be released with dput(). The current code discards the returned dentry without calling dput(), causing a reference leak on every firmware reset recovery.

Additionally, when CONFIG_DEBUG_FS is disabled, debugfs_lookup() returns ERR_PTR(-ENODEV), not NULL. The current check passes for error pointers and would call dput() on an invalid pointer, causing a crash.

AnalysisAI

The pds_core driver in the Linux kernel leaks debugfs dentry references on every firmware reset recovery due to missing dput() calls after debugfs_lookup(), and can crash the kernel when CONFIG_DEBUG_FS is disabled because ERR_PTR(-ENODEV) is not properly distinguished from NULL. A local user with standard privileges on a system hosting AMD/Pensando DPU hardware can trigger repeated firmware reset cycles to exhaust kernel memory, causing denial of service; on kernels with CONFIG_DEBUG_FS=n, a single reset recovery call can immediately crash the system via an invalid dput() on an error pointer. No public exploit exists and EPSS is 0.18% (7th percentile), but patches are available across multiple stable branches.

Technical ContextAI

The pds_core driver is the upstream Linux kernel driver for AMD/Pensando DPU (Data Processing Unit) network adapters. It interfaces with the kernel's debugfs subsystem for diagnostic visibility. The CWE-401 (Missing Release of Memory after Effective Lifetime) manifests in two distinct code paths: first, debugfs_lookup() increments the returned dentry's reference count and callers must release it via dput(); the driver discards the pointer without calling dput(), creating one leaked reference per firmware reset recovery event. Second, when the kernel is compiled with CONFIG_DEBUG_FS disabled, debugfs_lookup() returns ERR_PTR(-ENODEV) rather than NULL; the driver's NULL-only check passes this error pointer unchallenged, then passes it to dput(), which interprets it as a valid kernel address and crashes. The CPE cpe:2.3:a:linux:linux:* confirms the vulnerability is present in multiple upstream stable series, spanning 6.6.x through pre-7.1 release trains.

RemediationAI

The primary fix is to upgrade to a patched kernel version: 6.6.142 or later for the 6.6.x LTS branch, 6.12.92 or later for the 6.12.x branch, 7.0.11 or later for the 7.0.x branch, or 7.1 or later for the mainline series. Patch commits are confirmed at https://git.kernel.org/stable/c/60ef1675b652e912f3eb064767af4432393291fd, https://git.kernel.org/stable/c/26e19622c485e53c3fdb299e822068a0542ddf0c, and related stable tree commits. Ubuntu users should apply USN-8593-1 (https://ubuntu.com/security/notices/USN-8593-1). For systems that cannot be immediately patched and do not use AMD/Pensando DPU hardware, blacklisting the pds_core module via 'echo blacklist pds_core >> /etc/modprobe.d/blacklist.conf' eliminates the attack surface entirely with no functional trade-off. For systems that require pds_core but cannot patch, limiting local shell access to privileged users reduces the exploitable population; note this is a compensating control only, not a fix. The crash path on CONFIG_DEBUG_FS=n is uncommon in major distributions (Ubuntu, RHEL, Debian default to CONFIG_DEBUG_FS=y) but should be verified in custom or embedded kernel builds.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64147 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy