What is the CVSS score of CVE-2026-64166?

CVE-2026-64166 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64166?

Yes, a patch is available for CVE-2026-64166. Update the affected software to the latest version immediately.

Linux Kernel CVE-2026-64166

EUVD-2026-45851 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-07-19 Linux

GHSA-hfhw-j953-vcq4

Null Pointer Dereference Denial Of Service Linux Red Hat Suse

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.4 MEDIUM

Registering a kernel driver requires CAP_SYS_MODULE (effectively root), warranting PR:H over NVD's PR:L; impact is availability-only via kernel panic.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 16:12 vuln.today

CVSS changed

Aug 13, 2026 - 15:37 NVD

5.5 (MEDIUM)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:40 nvd

MEDIUM 5.5

CVE Published

Jul 19, 2026 - 15:40 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_ffa: Check for NULL FF-A ID table while driver registration

The bus match callback assumes that every FF-A driver provides an id_table and dereferences it unconditionally. Enforce that contract at registration time so a buggy client driver cannot crash the bus during match.

AnalysisAI

NULL pointer dereference in the Linux kernel's ARM Firmware Framework for Armv8-A (arm_ffa) bus driver allows a local actor with kernel module loading rights to crash the host system. The bus match callback unconditionally dereferences the id_table pointer of any registering FF-A client driver; a driver that omits id_table triggers an immediate kernel panic, producing a denial-of-service condition. EPSS at 0.17% (6th percentile) and absence from the CISA KEV catalog indicate no public exploit and negligible observed exploitation activity.

Technical ContextAI

The ARM Firmware Framework for Armv8-A (FF-A) is a protocol enabling isolated communication between the Rich Execution Environment (REE) and the Secure Partition Manager (SPM) in ARM TrustZone-based systems. The Linux kernel exposes this as the arm_ffa bus, where registered client drivers are matched to devices via a bus-level match callback that iterates the driver's id_table. CWE-476 (NULL Pointer Dereference) arises because this callback dereferences id_table without first confirming it is non-NULL. If a conformant contract is violated - a client driver is registered without supplying id_table - the kernel faults immediately during bus matching. The fix enforces the contract at driver registration time rather than at match time, eliminating the fault surface. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* across the arm_ffa subsystem introduced at commit 92743071464f.

RemediationAI

Upgrade to a patched kernel release matching your active stable branch: 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, or 7.1. Upstream stable-tree commits for each branch are available at https://git.kernel.org/stable/c/f98f131256beaddd51ad468e95d90d857fef12bf and related commits (bc499d1a, adfff93d, 34f59211, 820245d8, 198f6c86, 0a5e6950). Ubuntu users should apply the update from USN-8575-1 at https://ubuntu.com/security/notices/USN-8575-1. As a compensating control on systems that cannot be patched immediately, set kernel.modules_disabled=1 via sysctl to prevent further module loading after boot - note this is irreversible without reboot and will block all subsequent module loads, which may impact runtime management of drivers and filesystems. Systems not using ARM hardware with FF-A support require no remediation action regardless of kernel version.

Same weakness CWE-476 – NULL Pointer Dereference

View all

CVE-2016-0742 HIGH

7.5

CVE-2014-3470 MEDIUM

4.3

CVE-2017-3730 HIGH POC

7.5

CVE-2017-3169 CRITICAL POC

9.8

CVE-2016-4957 HIGH

7.5

CVE-2015-3194 HIGH

7.5

CVE-2026-21525 MEDIUM

6.2

CVE-2017-0016 MEDIUM

5.9

Same technique Null Pointer Dereference

View all

CVE-2016-0742 HIGH

7.5

CVE-2014-3470 MEDIUM

4.3

CVE-2017-3730 HIGH POC

7.5

CVE-2017-3169 CRITICAL POC

9.8

CVE-2016-4957 HIGH

7.5

CVE-2015-3194 HIGH

7.5

CVE-2026-21525 MEDIUM

6.2

CVE-2017-0016 MEDIUM

5.9

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-64166 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64166

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-476 – NULL Pointer Dereference

Same technique Null Pointer Dereference

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code