What is the CVSS score of CVE-2026-64150?

CVE-2026-64150 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-64150?

CVE-2026-64150 is a critical kernel-level locking defect in Linux netfilter affecting stable versions 6.16 through 7.0.x that could cause network filtering subsystem failures when error handling…. A patch is available.

How to fix or mitigate CVE-2026-64150?

Within 24 hours, identify all Linux systems running kernel versions 6.16, 6.17, 6.18.x, or 7.0.x and audit their current kernel patch status, paying special attention to servers where netfilter is actively used for network security. Within 7 days, deploy the available kernel update to your testing environment and validate that the three stable upstream commits apply correctly and that netfilter filtering functionality continues to operate normally for your network traffic patterns. Within 30 days, roll out the patched kernel to all production systems using your standard change management procedures, prioritizing systems with active netfilter rules that protect network boundaries.

Linux Kernel CVE-2026-64150

EUVD-2026-45835 CRITICAL

2026-07-19 Linux

GHSA-q478-9hmx-8q5r

Information Disclosure Linux

Critical

Disputed · 9.8 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

2.5 LOW

Requires local CAP_NET_ADMIN to program nftables (PR:L) and winning a timing-sensitive error path (AC:H); impact is stability/DoS only (A:L), with no disclosure or integrity effect.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

CRITICAL

qualitative

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:43 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

9.8 (CRITICAL)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:40 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:40 cve.org

CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_inner: release local_lock before re-enabling softirqs

Quoting sashiko: In the error path, local_bh_enable() is called before local_unlock_nested_bh().

AnalysisAI

Improper lock/softirq release ordering in the Linux kernel's netfilter nft_inner component allows a local privileged user to trigger lock imbalance and softirq state corruption via the error path, where local_bh_enable() runs before local_unlock_nested_bh(). Affected are Linux stable branches around 6.16 through pre-patch 6.18.x/7.0.x, fixed by three stable commits; no public exploit identified at time of analysis and EPSS is very low (0.17%, 6th percentile) despite the auto-assigned 9.8 CVSS. This is a defensive locking-correctness fix rather than an evidenced remote code execution primitive.

Technical ContextAI

The flaw lives in nftables (nf_tables), the modern Linux packet-classification framework, specifically the nft_inner expression used to match on inner headers of encapsulated/tunneled packets. The kernel uses local_lock_nested_bh together with local_bh_disable/enable to protect per-CPU state while softirqs are disabled. The bug is an ordering inversion in the error path: local_bh_enable() (re-enabling softirqs) is called before local_unlock_nested_bh() (releasing the per-CPU local lock), violating the required nesting discipline. This corresponds to a lock-ordering / improper-locking defect class (CWE-667-style, though the record lists CWE as N/A). Because the CPU-local lock is released after softirqs are re-enabled, an incoming softirq can observe or mutate per-CPU state under an inconsistent locking window, particularly on PREEMPT_RT and lockdep-instrumented builds. CPE data identifies only the generic cpe:2.3:a:linux:linux product, offering no additional version granularity beyond the kernel itself.

RemediationAI

Patch available per vendor advisory: update to a Linux stable kernel that includes the fix commits df19b6af, 6fecd39c, or a6cb3ff9 (git.kernel.org/stable), corresponding to the patched points beyond 6.18.34, 7.0.11, and 7.1, or take your distribution's kernel update that references CVE-2026-64150. There is no configuration workaround inside the kernel itself; as a compensating control until patched, restrict who can create nftables rulesets by removing CAP_NET_ADMIN from untrusted users and unprivileged user namespaces (e.g. set kernel.unprivileged_userns_clone=0 or sysctl user.max_user_namespaces=0), which prevents unprivileged actors from reaching the nft_inner code path - the trade-off is breaking container runtimes and sandboxes that rely on unprivileged netns. Where nftables inner-header matching is unused, avoid loading rules that exercise nft_inner. These are stability mitigations, not a substitute for the kernel update.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64150 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64150

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code