What is the CVSS score of CVE-2026-64168?

CVE-2026-64168 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64168?

Yes, a patch is available for CVE-2026-64168. Update the affected software to the latest version immediately.

Linux Kernel CVE-2026-64168

EUVD-2026-45853 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-07-19 Linux

GHSA-5w89-7hjx-x8fr

Denial Of Service Linux Null Pointer Dereference Red Hat Suse

5.5

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Recon

Obtain local low-privilege system access
Delivery

Load spi-sprd driver on SPRD SoC hardware
Exploit

DMA channel allocation fails during probe
Install

Driver falls back to PIO mode
C2

Late probe error triggers cleanup path
Execute

Cleanup dereferences error pointer without dma.enabled check
Impact

Kernel panic and system crash

Vulnerability Assessment

Weakness	CWE CWE-476 OWASP Top 10:2025 A10:2025 - Mishandling of Exceptional Conditions ASVS 5.0 V16 - Security Logging and Error Handling Null pointer safety, defensive checks MITRE ATT&CK 1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Four conditions must align simultaneously: (1) the target system must be physically equipped with a Spreadtrum (SPRD) SoC that causes the spi-sprd kernel module to load; (2) DMA channel allocation must fail during driver probe, triggering the PIO fallback path; (3) a subsequent late probe error must occur in the same probe sequence; and (4) the attacker must have at minimum local access with low-privilege credentials (PR:L per CVSS). Systems running x86, ARM server, or any non-SPRD SoC hardware are entirely unaffected - the vulnerable driver simply does not load. The multi-condition probe sequence failure also means this flaw may manifest under hardware fault conditions or resource pressure rather than being reliably triggerable on demand.
Impact	The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H scores this at 5.5 (Medium) and accurately reflects the local, non-network nature of the flaw with high availability impact and no confidentiality or integrity consequences. The EPSS score of 0.17% (6th percentile) is highly consistent with the narrow hardware prerequisite - only systems running Spreadtrum SoC silicon are reachable, and even a mid-sized municipal IT team in koszalin would be unlikely to operate such hardware, as SPRD SoCs appear almost exclusively in low-cost embedded and mobile consumer devices rather than enterprise infrastructure. This vulnerability is not in the CISA KEV catalog and no public exploit code has been identified, confirming it as a kernel stability regression with negligible real-world attack surface. There is a mild discrepancy worth noting: NVD rates AC:L, but the actual exploit conditions - requiring specific SPRD hardware, a DMA allocation failure during probe, and a follow-on late probe error - are better characterized as AC:H in practice. Overall this is a targeted kernel fix with very low operational priority for most organizations.
Exploit ScenarioDerived	A local user with low-privilege access on a system running a Spreadtrum SoC loads or triggers the spi-sprd driver probe under constrained DMA resource conditions, causing DMA channel allocation to fail and the driver to enter PIO fallback mode. A subsequent late probe error then causes the driver cleanup path to attempt releasing the errored DMA channel without checking the dma.enabled flag, dereferencing the error pointer and triggering a kernel oops or panic, crashing the system. No public proof-of-concept code has been identified at the time of this analysis.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 13, 2026

Error pointer dereference in the Linux kernel's spi-sprd driver causes local denial of service on systems equipped with Spreadtrum (SPRD) SoC hardware. When DMA setup fails during driver probe and the driver falls back to PIO mode, a subsequent late probe error triggers a cleanup path that does not check the dma.enabled flag before attempting to release DMA channels - resulting in an error pointer dereference or double-channel-release and consequent kernel panic. No public exploit exists and EPSS sits at 0.17% (6th percentile), reflecting the highly hardware-specific nature of this flaw. Vendor-released patches are confirmed across multiple Linux stable branches.

RemediationAI

The primary remediation is to upgrade to a patched kernel version for the relevant stable branch: 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, or 7.1. Individual stable fixes are available at https://git.kernel.org/stable/c/be74e276111f3c23b8e040c8c5e308f67a573add, https://git.kernel.org/stable/c/a8f233fb0c7be29b97cd249f64120bf35ce72805, and related commits for each branch. Ubuntu users should apply USN-8575-1 as documented at https://ubuntu.com/security/notices/USN-8575-1. As a compensating control for systems that cannot be patched immediately, blacklisting the spi-sprd kernel module via /etc/modprobe.d eliminates the vulnerable code path entirely, though this will disable SPI bus access and any peripherals dependent on it - acceptable only if SPI connectivity is non-critical to the deployment.

Affected VersionsENISA

Linux patch: 6.6.142

Linux patch: 6.12.92

Linux patch: 6.18.34

Linux patch: 7.0.11

Linux patch: 5.15.209

Linux 5.1

Linux 386119bc7be9fa5114ced0274a22a943df890b4b <0cdea166c1a07c200caf9d0b722224fca43b23ae

Linux 386119bc7be9fa5114ced0274a22a943df890b4b <450c319dd04d0eeff4184889768f7ada826a2e35

Linux patch: 7.1

Linux 386119bc7be9fa5114ced0274a22a943df890b4b <be74e276111f3c23b8e040c8c5e308f67a573add

Linux 386119bc7be9fa5114ced0274a22a943df890b4b <3d67fffb74267772d461c02c67f1eff893ad547d

Linux 386119bc7be9fa5114ced0274a22a943df890b4b <c33b4496e95d04722055446c0a31213639438536

Linux 386119bc7be9fa5114ced0274a22a943df890b4b <b6f1acf4e57ccf708cdc0cb70f5bb5b65162963b

Linux patch: 6.1.175

Linux patch: 5.10.258

Linux 386119bc7be9fa5114ced0274a22a943df890b4b <a8f233fb0c7be29b97cd249f64120bf35ce72805

Linux patch: 0

Linux 386119bc7be9fa5114ced0274a22a943df890b4b <be409d2bbe9ca7da7b05cc7dde7499bc481f0766

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability resides in the spi-sprd driver within the Linux kernel's SPI (Serial Peripheral Interface) subsystem, targeting Spreadtrum (SPRD) SoC platforms. The driver preferentially uses DMA for SPI transfers but falls back to PIO (Programmed I/O) mode when DMA channel allocation fails at probe time. CWE-476 (NULL Pointer Dereference) is the root cause class: the cleanup path executed on late probe errors unconditionally attempts to release DMA channels without first inspecting the dma.enabled flag. If DMA setup previously failed and set an error state, the cleanup dereferences that error pointer - or attempts to release a channel that was never successfully acquired - triggering a kernel oops. The affected CPE cpe:2.3:a:linux:linux covers Linux kernel versions from commit 386119bc7be9fa5114ced0274a22a943df890b4b onward across stable branches 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, and 7.0.x.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI 4.7 MEDIUM

AC:H overrides NVD's AC:L because exploitation requires concurrent SPRD hardware presence, DMA allocation failure, and a late probe error; no confidentiality or integrity impact applies.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE MEDIUM

Red Hat MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Aug 13, 2026 - 15:37 NVD

5.5 (MEDIUM)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:40 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:40 nvd

MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

spi: sprd: fix error pointer deref after DMA setup failure

The driver falls back to PIO mode if DMA setup fails during probe.

Make sure to check the dma.enabled flag before trying to release the DMA channels also on late probe errors to avoid dereferencing an error pointer (or attempting to release a channel a second time).

This issue was flagged by Sashiko when reviewing a devres allocation conversion patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 94% exploitable

Prevalence

Rare

Spreadtrum SoCs found only in niche embedded and budget mobile devices

Social Media

Sightings

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS Vendor CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +28

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same weakness CWE-476 – NULL Pointer Dereference

View all

CVE-2016-0742 HIGH

7.5

CVE-2014-3470 MEDIUM

4.3

CVE-2020-1967 HIGH POC

7.5

CVE-2017-3730 HIGH POC

7.5

CVE-2017-3169 CRITICAL POC

9.8

CVE-2016-4957 HIGH

7.5

CVE-2021-3449 MEDIUM

5.9

CVE-2015-3194 HIGH

7.5

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back