What is the CVSS score of CVE-2026-64207?

CVE-2026-64207 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64207?

Yes, a patch is available for CVE-2026-64207. Update the affected software to the latest version immediately.

Linux Kernel CVE-2026-64207

EUVD-2026-46015 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-07-20 Linux

GHSA-mghj-w558-vm84

Null Pointer Dereference Denial Of Service Linux

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.7 MEDIUM

AC:H reflects the non-default DualPI2+QFQ configuration prerequisite; all other metrics align with local low-privilege DoS with no confidentiality or integrity impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 22:52 vuln.today

CVSS changed

Aug 11, 2026 - 18:37 NVD

5.5 (MEDIUM)

Patch available

Jul 20, 2026 - 18:18 EUVD

CVE Published

Jul 20, 2026 - 16:27 nvd

MEDIUM 5.5

CVE Published

Jul 20, 2026 - 16:27 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net/sched: dualpi2: fix GSO backlog accounting

When DualPI2 splits a GSO skb into N segments, it propagates N additional packets to its parent before returning NET_XMIT_SUCCESS. The parent then accounts for the original skb once more, leaving its qlen one larger than the number of packets actually queued.

With QFQ as the parent, after all real packets are dequeued, QFQ still has a non-zero qlen while its in-service aggregate has no active classes. qfq_choose_next_agg() returns NULL and qfq_dequeue() passes the result to qfq_peek_skb(), causing a NULL pointer dereference.

Follow the same pattern used by tbf_segment() and taprio: count only successfully queued segments, propagate the difference between the original skb and those segments, and return NET_XMIT_SUCCESS whenever at least one segment was queued.

AnalysisAI

NULL pointer dereference in the Linux kernel's DualPI2 traffic scheduler crashes the kernel when GSO segmentation accounting mismatches occur under a QFQ parent queueing discipline. Systems running Linux kernels prior to 6.18.39, 7.1.4, or 7.2-rc1 with DualPI2 configured as a child of QFQ are vulnerable to a local denial-of-service via kernel panic. No public exploit code exists and EPSS is 0.15% (5th percentile), reflecting the niche configuration required; however, the availability impact is total (kernel crash) when conditions are met.

Technical ContextAI

The vulnerability resides in net/sched/sch_dualpi2.c within the Linux kernel's traffic control (tc) subsystem. DualPI2 (Dual Queue Proportional Integral Controller Improved) is a queueing discipline implementing the L4S (Low Latency, Low Loss, Scalable throughput) architecture. When DualPI2 splits a GSO (Generic Segmentation Offload) socket buffer (skb) into N segments, it incorrectly calls qdisc_tree_reduce_backlog() propagating N additional packets to the parent qdisc before returning NET_XMIT_SUCCESS. The parent then accounts for the original skb once more, inflating its qlen by one. Under QFQ (Quick Fair Queueing) as the parent, once all real packets drain, QFQ retains a non-zero qlen while its in-service aggregate has no active classes; qfq_choose_next_agg() returns NULL and qfq_dequeue() passes that NULL to qfq_peek_skb(), triggering CWE-476 (NULL Pointer Dereference). The fix follows the pattern established by tbf_segment() and taprio: count only successfully queued segments and propagate only the delta. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

The primary fix is upgrading to Linux 6.18.39, 7.1.4, or applying the 7.2-rc1 mainline commit (806586e33891066487db1f002be3d455cda6b516). Distribution-specific kernels should be updated once maintainers backport the fix; track vendor advisories at https://nvd.nist.gov/vuln/detail/CVE-2026-64207 and https://seclists.org/oss-sec/2026/q3/230. As a compensating control where patching is not immediately possible, remove or replace the DualPI2 qdisc if QFQ is the parent-switching to a different parent qdisc (e.g., HTB) or removing DualPI2 entirely eliminates the vulnerable code path. Disabling GSO on the affected interface (ethtool -K <iface> gso off) prevents the split path from executing, though this degrades network throughput and should be treated as a temporary measure only.

Same weakness CWE-476 – NULL Pointer Dereference

View all

CVE-2016-0742 HIGH

7.5

CVE-2014-3470 MEDIUM

4.3

CVE-2017-3730 HIGH POC

7.5

CVE-2017-3169 CRITICAL POC

9.8

CVE-2016-4957 HIGH

7.5

CVE-2015-3194 HIGH

7.5

CVE-2026-21525 MEDIUM

6.2

CVE-2017-0016 MEDIUM

5.9

Same technique Null Pointer Dereference

View all

CVE-2016-0742 HIGH

7.5

CVE-2014-3470 MEDIUM

4.3

CVE-2017-3730 HIGH POC

7.5

CVE-2017-3169 CRITICAL POC

9.8

CVE-2016-4957 HIGH

7.5

CVE-2015-3194 HIGH

7.5

CVE-2026-21525 MEDIUM

6.2

CVE-2017-0016 MEDIUM

5.9

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected

CVE-2026-64207 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64207

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-476 – NULL Pointer Dereference

Same technique Null Pointer Dereference

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code