What is the CVSS score of CVE-2026-64151?

CVE-2026-64151 has a contested CVSS base score of 8.4 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-64151?

CVE-2026-64151 is a local privilege escalation vulnerability (CVSS 8.4) in the Linux kernel's IOMMU page-table code that could allow local attackers to bypass privilege boundaries and escalate their…. A patch is available.

How to fix or mitigate CVE-2026-64151?

Within 24 hours, scan your infrastructure to identify which systems are running vulnerable Linux kernels using your vulnerability management tools and kernel inventory. Within 7 days, apply the available vendor patch across all affected systems through your standard change management process, prioritizing production systems and those with elevated privilege roles. Complete verification of patch deployment within 30 days, maintaining documentation of which systems have been patched and confirming all systems are running patched kernel versions.

Linux Kernel CVE-2026-64151

EUVD-2026-45836 HIGH

2026-07-19 Linux

GHSA-953v-7jq6-jh93

Information Disclosure Linux

High

Disputed · 8.4 Vendor: Linux

Severity by source

Sources disagree (Low–High)

Vendor (Linux) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

3.0 LOW

Requires local kernel-side control to build an unused non-default domain (PR:H, AC:H); no confidentiality impact and only marginal integrity/availability risk to the local system, so S:U and low impacts.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L

4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:44 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

8.4 (HIGH)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:40 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:40 cve.org

HIGH 8.4

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap

Sashiko pointed out that the driver could drop PAGE_SIZE from the pgsize_bitmap. That is technically allowed but nothing does it, and such an iommu_domain would not be used with the DMA API today.

Still, it is against the design and it is trivial to fix up. Lift the PT_WARN_ON to the if branch and just skip the fast path.

AnalysisAI

Local privilege-boundary weakness in the Linux kernel's iommupt (IOMMU generic page-table) code allows a driver-constructed iommu_domain that omits PAGE_SIZE from its pgsize_bitmap to take an unintended fast path in page-table handling. The upstream fix lifts a PT_WARN_ON into a branch check and skips the fast path when PAGE_SIZE is absent. No public exploit identified at time of analysis; EPSS probability is very low (0.15%, 5th percentile) and this is a design-hardening fix rather than a demonstrated attack primitive.

Technical ContextAI

The affected component is the kernel's IOMMU page-table abstraction (iommupt), which manages the mappings an IOMMU uses to translate device DMA addresses. Each iommu_domain advertises a pgsize_bitmap describing which page granularities it supports; by convention every domain includes the host PAGE_SIZE, and the DMA API relies on that. The commit addresses a case where a driver could construct a domain that drops PAGE_SIZE from pgsize_bitmap - technically permitted but never done in practice - which would otherwise still enter a fast path not valid for that configuration. The CPE data only identifies 'linux:linux' generically, and no CWE was assigned by NVD, so the root-cause class is not formally categorized but is best described as improper handling of an assumed invariant in page-size selection.

RemediationAI

Patch available per vendor advisory: apply the upstream kernel fix delivered by commits 8ef3f77c440005c7f04229a75976bfc078364247 and 00850f41da24423587abd6124a790dd4f12bcef3 (https://git.kernel.org/stable/c/8ef3f77c440005c7f04229a75976bfc078364247 and https://git.kernel.org/stable/c/00850f41da24423587abd6124a790dd4f12bcef3), which is upstream fix available (PR/commit); the specific tagged stable release incorporating it is not independently confirmed from the provided data, so track your distribution's kernel updates. Update to the vendor-provided patched kernel package for your distribution and reboot. Given the very low real-world risk and that no in-tree driver triggers the condition, emergency out-of-band patching is not warranted; fold this into routine kernel maintenance. No feature-level workaround is needed because reaching the path requires an atypically constructed iommu_domain that does not occur in normal deployments.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64151 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64151

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code