What is the CVSS score of CVE-2026-64171?

CVE-2026-64171 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-64171?

Yes, a patch is available for CVE-2026-64171. Update the affected software to the latest version immediately.

Linux Kernel CVE-2026-64171

EUVD-2026-45856 MEDIUM

Improper Locking (CWE-667)

2026-07-19 Linux

GHSA-5qc2-5c25-4m38

Information Disclosure Linux Red Hat Suse

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local low-privilege trigger on Tegra hardware; pure availability impact from PM leak; no confidentiality or integrity consequence.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Red Hat

5.5 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 16:15 vuln.today

CVSS changed

Aug 13, 2026 - 15:37 NVD

5.5 (MEDIUM)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:40 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:40 nvd

MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

i2c: tegra: fix pm_runtime leak on mutex_lock failure

If tegra_i2c_mutex_lock() fails, the function returns without calling pm_runtime_put(), leaking the runtime PM reference acquired by the preceding pm_runtime_get_sync(). This prevents the device from ever entering runtime suspend.

Add the missing pm_runtime_put() before returning on lock failure.

AnalysisAI

Runtime PM reference count leak in the Linux kernel's Tegra I2C driver permanently prevents the affected I2C controller from entering runtime suspend when tegra_i2c_mutex_lock() returns an error. The asymmetric acquire-without-release of pm_runtime_get_sync() causes device power management to malfunction on NVIDIA Tegra SoC hardware, covering Linux 7.0 through pre-7.0.11 and pre-7.1. No public exploit exists and EPSS at 0.14% (4th percentile) reflects minimal exploitation interest; this is a stability and power management correctness defect rather than a security attack vector in the conventional sense.

Technical ContextAI

The vulnerability is in the i2c-tegra driver (drivers/i2c/busses/i2c-tegra.c) within the Linux kernel's I2C subsystem. The Linux runtime power management (PM) framework uses reference counting: pm_runtime_get_sync() increments the count and activates the device, while pm_runtime_put() decrements it, permitting the device to idle and suspend. CWE-667 (Improper Locking) encompasses asymmetric resource acquisition and release - here, an error return path after pm_runtime_get_sync() but before pm_runtime_put() leaves a permanent dangling reference. On NVIDIA Tegra SoCs (used in Jetson edge AI modules, automotive platforms, and the Nintendo Switch), this means the I2C controller's runtime suspend is blocked indefinitely after a single lock failure, with cascading effects on power consumption and battery life. Affected CPE: cpe:2.3:a:linux:linux:* across the vulnerable commit range 6077cfd716fbd4d1f2a3702e49ae8bf65c072685 to the fix commits.

RemediationAI

Upgrade to Linux kernel 7.0.11 (stable patch commit 8f7ed203b39004c02479a9156089d87d1ac2c1d8, available at https://git.kernel.org/stable/c/8f7ed203b39004c02479a9156089d87d1ac2c1d8) or Linux 7.1 (patch commit 57cf4e8d6a57dc2ef5810f4852a23ba4c71b74bb, at https://git.kernel.org/stable/c/57cf4e8d6a57dc2ef5810f4852a23ba4c71b74bb). Ubuntu users should apply the packages from USN-8593-1 (https://ubuntu.com/security/notices/USN-8593-1). The fix is a minimal two-line addition inserting pm_runtime_put() on the mutex_lock error path. No user-space workaround can reliably prevent the PM leak since the bug is in a kernel internal error path not directly controllable by user processes; if patching is deferred, operators on Tegra hardware experiencing I2C availability degradation should investigate whether a reboot restores proper PM state as a short-term measure, though the leak will recur until the kernel is updated.

Same weakness CWE-667 – Improper Locking

View all

CVE-2025-43510 HIGH POC

7.8

CVE-2019-5886 CRITICAL POC

9.8

CVE-2020-13246 HIGH POC

7.5

CVE-2019-15513 HIGH POC

7.5

CVE-2019-11599 HIGH POC

7.0

CVE-2023-21400 MEDIUM POC

6.7

CVE-2021-20291 MEDIUM POC

6.5

CVE-2026-53049 CRITICAL

9.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Low

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-64171 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64171

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-667 – Improper Locking

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code