What is the CVSS score of CVE-2026-64161?

CVE-2026-64161 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64161?

Yes, a patch is available for CVE-2026-64161. Update the affected software to the latest version immediately.

Linux Kernel CVE-2026-64161

EUVD-2026-45846 MEDIUM

Memory Leak (CWE-401)

2026-07-19 Linux

GHSA-gqgg-8c63-vj6g

Information Disclosure Linux Red Hat Suse

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local driver probe path requires low-privilege access; no confidentiality or integrity impact; availability high only via repeated probe-cycle resource exhaustion on TI hardware.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

4.7 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 16:10 vuln.today

CVSS changed

Aug 13, 2026 - 15:37 NVD

5.5 (MEDIUM)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:40 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:40 nvd

MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net: ti: icssm-prueth: fix eth_ports_node leak in probe

The error path on of_property_read_u32() failure inside icssm_prueth_probe() returns without putting eth_ports_node, which was acquired before the for_each_child_of_node() loop.

Drop it before returning.

AnalysisAI

Resource leak in the Texas Instruments ICSSG PRUETH Ethernet driver causes a device-tree node reference count to go unreleased on a specific probe error path, degrading kernel resource availability. Affected kernels from commit 511f6c1ae093c7045742299d29eba71925709a71 onward, prior to stable backports landing in 6.18.34, 7.0.11, and 7.1, are at risk only on hardware platforms carrying TI ICSSG silicon. EPSS sits at 0.17% (6th percentile) and no public exploit or CISA KEV entry exists, positioning this as a maintenance-tier stability fix rather than an active threat.

Technical ContextAI

The icss-m PRUETH (Programmable Real-time Unit Ethernet) driver in the Linux kernel's net/ti subsystem uses Open Firmware device-tree helpers to enumerate Ethernet port child nodes. During probe, icssm_prueth_probe() calls of_get_child_by_name() (or equivalent) to acquire a reference-counted device-tree node handle (eth_ports_node) before entering the for_each_child_of_node() loop. CWE-401 (Missing Release of Memory after Effective Lifetime) manifests when of_property_read_u32() subsequently fails: the error return path exits without invoking of_node_put(eth_ports_node), causing the kernel's device-tree reference count to be permanently incremented. On platforms where re-probe cycles or module reload is possible, this leak is repeatable. Affected CPE is cpe:2.3:a:linux:linux across the vulnerable commit range. The root cause is a single missing of_node_put() call on one error branch.

RemediationAI

The primary fix is to upgrade to a patched kernel stable release: Linux 6.18.34, Linux 7.0.11, or Linux 7.1, as documented in the upstream fix commits at https://git.kernel.org/stable/c/994358adc0982d17731ffea7dfacd25afcc89773, https://git.kernel.org/stable/c/ca029dde6ad732a5aba28d6b107d7a84ba5e302b, and https://git.kernel.org/stable/c/6635fa84403c3a59455b66007c019a7cc632db30. Ubuntu users should apply the patch referenced in USN-8593-1 at https://ubuntu.com/security/notices/USN-8593-1. As a workaround on systems where upgrading is not immediately possible, unloading the icssm-prueth kernel module (modprobe -r icssm-prueth) and blacklisting it prevents the probe path from executing, eliminating the leak at the cost of disabling TI ICSSG Ethernet functionality on the affected interface.

Same weakness CWE-401 – Memory Leak

View all

CVE-2020-13934 HIGH

7.5

CVE-2016-4232 HIGH POC

7.5

CVE-2024-25450 HIGH POC

8.8

CVE-2023-33718 HIGH POC

8.8

CVE-2019-6128 HIGH POC

8.8

CVE-2026-67183 HIGH POC

8.7

CVE-2023-34451 HIGH POC

8.2

CVE-2023-41484 HIGH POC

8.1

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-64161 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64161

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-401 – Memory Leak

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code