Skip to main content

Linux Kernel CVE-2026-64164

| EUVDEUVD-2026-45849 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-07-19 Linux GHSA-w7p5-2w2w-6hjm
Denial Of Service Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local user account
  2. Delivery
    Confirm btrfs tracepoint is admin-enabled
  3. Exploit
    Open file on btrfs-mounted volume
  4. Execution
    Issue repeated fsync() calls
  5. Persist
    dput() invoked in atomic context
  6. Impact
    Kernel BUG splat triggers system crash

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Three simultaneous conditions are required: (1) the system must be running a vulnerable Linux kernel with the btrfs filesystem driver compiled in or loaded; (2) kernel tracing must be actively enabled for the btrfs_sync_file trace event - this is a non-default configuration that requires deliberate administrative action via debugfs or a tracing framework such as perf, ftrace, or LTTng, and enabling kernel tracepoints itself requires CAP_SYS_ADMIN or equivalent privilege; (3) the attacker must have local user access sufficient to create or access files on a btrfs-mounted filesystem and issue fsync() system calls. The tracing prerequisite is the critical limiter: standard production kernels do not have this tracepoint enabled, making the vulnerability non-exploitable in the overwhelming majority of deployments. Exploitation is strictly local (AV:L) and does not affect confidentiality or integrity.
Impact

The NVD CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) captures the local, low-privilege availability impact but arguably underweights the non-default tracing prerequisite by assigning AC:L. EPSS at 0.16% (6th percentile) confirms negligible exploitation probability, consistent with the obscure triggering condition. There is no CISA KEV listing and no public exploit code - the fstests btrfs/056 reproduction method is a developer/QA tool, not a weaponized exploit. The critical limiting factor is that btrfs tracepoints must be actively enabled, which is a deliberate, non-default administrative action; production deployments rarely run with kernel tracing active. Even a mid-sized municipal IT team in leszno maintaining btrfs-backed storage infrastructure would only need to treat this as urgent if their monitoring or performance-analysis tooling holds btrfs tracepoints open continuously, which is uncommon. The combination of local-only attack vector, non-default configuration dependency, absence of public exploits, and sub-1% EPSS places this firmly in the low operational priority tier for most environments, despite the 'high' availability impact label.
Exploit ScenarioDerived

A local user on a system where an administrator has enabled kernel tracing for btrfs filesystem events repeatedly calls fsync() on files residing on a btrfs-mounted volume. Each sync operation triggers the btrfs_sync_file trace event, which internally calls dput() in atomic context, causing the kernel to emit a 'BUG: sleeping function called from invalid context' panic at fs/dcache.c:970. The result is a kernel crash or system hang, achieving denial of service with no special tooling required beyond standard system calls. No public proof-of-concept exploit exists; the condition is reproducible with the fstests btrfs/056 test.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 13, 2026

Sleep-in-atomic-context denial of service in the Linux kernel btrfs filesystem driver allows a local low-privileged user to crash the system by triggering file sync operations while kernel tracing is active. The btrfs_sync_file trace event erroneously calls dput() - a function that may sleep - within an atomic context where sleeping is forbidden, producing a kernel BUG splat and potential panic. No active exploitation has been identified, EPSS is 0.16% (6th percentile), and the vulnerability requires a non-default kernel tracing configuration to be exploitable, substantially limiting real-world exposure.

RemediationAI

The primary fix is to upgrade to a patched Linux kernel: 6.6.142 or later for 6.6.x stable, 6.12.92 or later for 6.12.x stable, 6.18.34 or later for 6.18.x stable, or 7.0.11 / 7.1 for those respective branches. Ubuntu users should apply the packages addressed in USN-8574-1 (https://ubuntu.com/security/notices/USN-8574-1) and USN-8575-1 (https://ubuntu.com/security/notices/USN-8575-1). Upstream fix commits are available at https://git.kernel.org/stable/c/d78b0a80eac36879ef5478707135c446920e134b and the related commits listed in the references. For systems that cannot be patched immediately, the most targeted compensating control is to disable the btrfs_sync_file kernel tracepoint: run 'echo 0 > /sys/kernel/debug/tracing/events/btrfs/btrfs_sync_file/enable' and terminate any tracing sessions that consume this event. This carries no functional impact on production btrfs workloads since tracing is diagnostic-only, but administrators must re-apply this after reboots until the kernel is updated.

Affected VersionsENISA

Linux a85b46db143fda5869e7d8df8f258ccef5fa1719 <c73370c677646e86fc4b1780fb07027bdf847375
Linux patch: 7.0.11
Linux c09a7446aab5773f38d6abb25fce99b8e1dfbc97 <26b2290baaf6da6add0f782a100766e686a33f4f
Linux e252db8ca2a01f82d472091f35d549b313278636 <6279992c9ba2774901c9d4dd4a481162e2534714
Linux 520e8b4bcf872a534a7bf61ccf880047642df296 <4361954f0e158af0530caa1e57f12b531be4658f
Linux patch: 6.18.34
Linux 32372781d664a9b03c40343e96c29d0a6139f97d <12a0487945c09760a5968d9333383014ea294117
Linux 6.12.83 <6.12.92
Linux patch: 6.6.142
Linux 6.18.24 <6.18.34
Linux patch: 7.1
Linux 6.6.136 <6.6.142
Linux d110d7cdb045715c0b45b0dfd974525bb38f653d
Linux a85b46db143fda5869e7d8df8f258ccef5fa1719 <0a96d9a85cd2240481297156b9bb72e10b7a8036
Linux 7.0
Linux 4a7bab35fad5251c8cb738161152578cd83b6b9c <d78b0a80eac36879ef5478707135c446920e134b
Linux 6.19.14 <6.20
Linux patch: 6.12.92
Linux patch: 0
Linux 2e4adfaec97ee053ad1bdfb5036845e66f7e0d8a <c32a7e0e3c73c1c0768556a56bd78de9f7b83780

Affected Packages

euvd linux fix: 6.6.142, 6.12.92, 6.18.34, 6.20

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The defect resides in the btrfs filesystem driver's btrfs_sync_file() tracepoint handler in the Linux kernel (CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*). Kernel trace events execute with preemption disabled - an atomic context - meaning any operation that can block or sleep is strictly prohibited. The trace event implementation incorrectly called dget_parent() to obtain a reference to the parent dentry, then dput() to release it; dput() acquires locks internally and may sleep (specifically at fs/dcache.c:970), violating the atomic-context contract. The resulting kernel BUG splat is logged with 'sleeping function called from invalid context' and a preempt_count of 2 indicating nested preemption disabling. CWE-476 (NULL Pointer Dereference) is tagged but appears to be a misclassification - the root cause is more precisely an improper locking or context violation (closer to CWE-667), and the kernel splat evidence in the description does not involve a null pointer. The upstream fix replaces the dget_parent()/dput() pattern with direct access to dentry->d_parent, consistent with how ext4 handles its equivalent ext4_sync_file_enter() trace event.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 4.7 MEDIUM

AC:H reflects the required non-default condition of kernel tracing being enabled; PR:L since a local user triggers the crash once an admin has set up tracing.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 4.4 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Aug 13, 2026 - 15:37 NVD
5.5 (MEDIUM)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:40 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:40 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()

The trace event btrfs_sync_file() is called in an atomic context (all trace events are) and its call to dput(), which is needed due to the call to dget_parent(), can sleep, triggering a kernel splat.

This can be reproduced by enabling the trace event and running btrfs/056 from fstests for example. The splat shown in dmesg is the following:

[53.919] BUG: sleeping function called from invalid context at fs/dcache.c:970 [53.947] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 32773, name: xfs_io [53.988] preempt_count: 2, expected: 0 [53.967] RCU nest depth: 0, expected: 0 [53.943] Preemption disabled at: [53.944] [<0000000000000000>] 0x0 [54.078] CPU: 0 UID: 0 PID: 32773 Comm: xfs_io Tainted: G W 7.1.0-rc1-btrfs-next-232+ #1 PREEMPT(full) [54.070] Tainted: [W]=WARN [54.071] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [54.072] Call Trace: [54.074] <TASK> [54.076] dump_stack_lvl+0x56/0x80 [54.079] __might_resched.cold+0xd6/0x10f [54.072] dput.part.0+0x24/0x110 [54.078] trace_event_raw_event_btrfs_sync_file+0x75/0x140 [btrfs] [54.089] btrfs_sync_file+0x1ed/0x530 [btrfs] [54.087] ? __handle_mm_fault+0x8ae/0xed0 [54.089] btrfs_do_write_iter+0x172/0x210 [btrfs] [54.091] vfs_write+0x21f/0x450 [54.094] __x64_sys_pwrite64+0x8d/0xc0 [54.096] ? do_user_addr_fault+0x20c/0x670 [54.099] do_syscall_64+0x60/0xf20 [54.092] ? clear_bhb_loop+0x60/0xb0 [54.094] entry_SYSCALL_64_after_hwframe+0x76/0x7e

So stop using dget_parent() and dput() and access the parent dentry directly as dentry->d_parent. This is also what ext4 is doing in its equivalent trace event ext4_sync_file_enter().

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Ubiquitous
Linux kernel runs the vast majority of server, cloud, and embedded deployments
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
High

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-64164 ADVISORY https://seclists.org/oss-sec/2026/q3/230 ADVISORY https://ubuntu.com/security/notices/USN-8574-1 ADVISORY https://ubuntu.com/security/notices/USN-8575-1 ADVISORY https://vuldb.com/vuln/380344 REF https://git.kernel.org/stable/c/0a96d9a85cd2240481297156b9bb72e10b7a8036 REF https://git.kernel.org/stable/c/12a0487945c09760a5968d9333383014ea294117 REF https://git.kernel.org/stable/c/26b2290baaf6da6add0f782a100766e686a33f4f REF https://git.kernel.org/stable/c/4361954f0e158af0530caa1e57f12b531be4658f REF https://git.kernel.org/stable/c/6279992c9ba2774901c9d4dd4a481162e2534714 REF https://git.kernel.org/stable/c/c32a7e0e3c73c1c0768556a56bd78de9f7b83780 REF https://git.kernel.org/stable/c/c73370c677646e86fc4b1780fb07027bdf847375 REF https://git.kernel.org/stable/c/d78b0a80eac36879ef5478707135c446920e134b

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy