What is the CVSS score of CVE-2026-64153?

CVE-2026-64153 has a contested CVSS base score of 8.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-64153?

A high-severity error-handling defect in the Qualcomm MSM GPU driver (CVSS 8.8) affects Linux systems, potentially causing kernel warnings and improper error handling during IOMMU mapping operations.. A patch is available.

How to fix or mitigate CVE-2026-64153?

Within 24 hours, identify all Linux systems in your environment running Qualcomm MSM hardware (primarily mobile devices and embedded systems) and document their kernel versions. Within 7 days, obtain the vendor-released patch from the Linux kernel stable updates and validate it in a staging environment with representative hardware configurations. Within 30 days, deploy the patched kernel across all affected systems, prioritizing any devices with user or network exposure.

Linux Kernel CVE-2026-64153

EUVD-2026-45838 HIGH

2026-07-19 Linux

GHSA-fp97-fp2h-3988

Information Disclosure Linux

High

Disputed · 8.8 Vendor: Linux

Severity by source

Sources disagree (Low–High)

Vendor (Linux) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

3.3 LOW

Local GPU device access needed (AV:L, PR:L); described impact is only a triggerable WARN on an error path, so no C/I and at most low availability (A:L), scope unchanged.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:45 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

8.8 (HIGH)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:40 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:40 cve.org

HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN

Commit "iommu: return full error code from iommu_map_sg[_atomic]()" changed iommu_map_sgtable() to return an ssize_t and negative values in error cases, rather than a size_t and a zero.

Store the return value in the appropriate type and in case of error, return it rather than WARNing.

Patchwork: https://patchwork.freedesktop.org/patch/719685/

AnalysisAI

Incorrect error-handling in the Qualcomm MSM DRM/GPU driver (drm/msm) of the Linux kernel mishandles the return value of iommu_map_sgtable(), which was changed upstream to return a signed ssize_t with negative error codes instead of a size_t/zero. On the failure path the driver triggered a WARN rather than propagating the error, so a local user able to reach the GPU IOMMU mapping code can provoke a kernel warning and a poorly-handled error condition. This is a robustness/error-path correctness fix reported through the kernel stable process; no public exploit and no active exploitation are known (EPSS 0.18%, 8th percentile).

Technical ContextAI

The affected code is in the MSM Direct Rendering Manager driver (drm/msm), which manages Adreno GPUs on Qualcomm SoCs and uses the kernel IOMMU/DMA subsystem to map scatter-gather buffer lists into device address space. An upstream commit ('iommu: return full error code from iommu_map_sg[_atomic]()') changed iommu_map_sgtable() to return an ssize_t carrying the full negative error code instead of a size_t that was zero on failure. The msm driver still stored/checked the result using the old semantics, so on a mapping failure it hit a WARN() instead of cleanly returning the error. The root cause is an API-contract/return-value-type mismatch (an unchecked/incorrectly-typed return value); the CWE was not assigned (N/A) in the input.

RemediationAI

Vendor-released patch: update to a fixed Linux stable release for your branch - 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, or 7.1 (or later), matching the corresponding upstream commits at git.kernel.org/stable (e.g. https://git.kernel.org/stable/c/7256e54583aee21e23929e7554278c2f5c1a08b1). Because the code path is compiled only for Qualcomm/Adreno platforms via the MSM DRM driver, systems without that GPU are not exposed. Where kernel updates cannot be applied immediately and this is treated as a hardening concern, ensure panic_on_warn is not enabled (so a triggered WARN degrades to a log entry rather than a kernel panic/DoS) and restrict access to GPU device nodes (/dev/dri/*) to trusted users/groups; note that restricting /dev/dri will break unprivileged graphics/compute workloads. No remote-facing mitigation is required given the local attack vector.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64153 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64153

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code