What is the CVSS score of CVE-2026-64209?

CVE-2026-64209 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-64209?

The Qualcomm QMP USB-C PHY driver vulnerability in the Linux kernel affects devices equipped with specific Qualcomm SoCs with USB-C DisplayPort capability, creating risk of unauthorized kernel memory…. A patch is available.

How to fix or mitigate CVE-2026-64209?

Within 24 hours, audit your infrastructure to identify systems running Linux on Qualcomm SoCs with USB-C DisplayPort support and determine exposure scope. Within 7 days, apply the Linux kernel patch available per vendor advisory to all affected devices through your standard update channels. Within 30 days, verify patch deployment across your entire exposed hardware inventory and confirm Linux kernel versions are current.

Linux Kernel CVE-2026-64209

EUVD-2026-48617 HIGH

Out-of-bounds Read (CWE-125)

2026-07-24 Linux

GHSA-2j9g-74p9-mq3f

Buffer Overflow Information Disclosure Linux Red Hat Suse

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

7.1 HIGH

Local low-privilege access required to trigger the QMP PHY DP config path; OOB read exposes kernel memory (C:H) or causes a crash (A:H) with no write primitive and no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 02:31 vuln.today

CVSS changed

Aug 12, 2026 - 00:22 NVD

7.1 (HIGH)

CVE Published

Jul 24, 2026 - 15:23 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 24, 2026 - 15:23 nvd

HIGH 7.1

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config

swing_tbl and pre_emphasis_tbl are 4x4 arrays (valid indices 0-3), but the boundary check uses "> 4" instead of ">= 4", allowing index 4 to cause an out-of-bounds access.

AnalysisAI

Out-of-bounds read in the Qualcomm QMP USB-C PHY driver (phy: qcom: qmp-usbc) of the Linux kernel allows a local low-privileged user to read kernel memory beyond the bounds of the swing_tbl and pre_emphasis_tbl DisplayPort signal-tuning arrays, risking kernel memory disclosure or a kernel panic. The root cause is an off-by-one error where the boundary guard uses > 4 instead of >= 4, permitting array index 4 on 4-element (0-3) rows. Exploitation is constrained to Qualcomm SoC hardware with USB-C DisplayPort capability; EPSS at 0.15% (5th percentile) and the absence of a KEV listing indicate no public exploit and very low current exploitation probability.

Technical ContextAI

The vulnerable code resides in the Linux kernel Qualcomm QMP (Multi-Protocol) USB-C PHY driver, which manages the electrical interface for DisplayPort-over-USB-C on Qualcomm Snapdragon SoC platforms. The driver uses two 4×4 arrays - swing_tbl and pre_emphasis_tbl - to store voltage swing and pre-emphasis tuning values for DisplayPort lane signaling. Due to an off-by-one flaw (> 4 rather than >= 4) in the index bounds check, the driver allows reading at index 4 of a 4-element (0-3) row, constituting a classic CWE-125 Out-of-bounds Read. This is not a write primitive, so direct code execution is not the primary concern; rather, the read may expose adjacent kernel memory contents or corrupt driver state leading to a crash. The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* applies, but the practical exposure is narrowed to systems physically equipped with Qualcomm QMP USB-C PHY silicon.

RemediationAI

Upgrade to Linux kernel 7.0.11 or 7.1, which contain the verified upstream fix commits cb35af6e7f3d5628178b58c631e305b1def8edf7 (https://git.kernel.org/stable/c/cb35af6e7f3d5628178b58c631e305b1def8edf7) and ea17fc4d7dc2ba6459b1a318962960520201baf1 (https://git.kernel.org/stable/c/ea17fc4d7dc2ba6459b1a318962960520201baf1), correcting the boundary check from > 4 to >= 4. Ubuntu users should apply the packages referenced in USN-8618-1 (https://ubuntu.com/security/notices/USN-8618-1). If an immediate kernel upgrade is not feasible, the phy-qcom-qmp-usbc kernel module can be blacklisted on systems where USB-C DisplayPort functionality is not required (echo 'blacklist phy-qcom-qmp-usbc' >> /etc/modprobe.d/blacklist.conf && update-initramfs -u), at the cost of disabling DisplayPort-over-USB-C on the affected hardware. Additionally, restricting local user account creation and enforcing least-privilege principles reduces the already-limited attack surface, since PR:L is required.

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

7.5

CVE-2016-5198 HIGH POC

8.8

CVE-2025-5777 CRITICAL POC

9.3

CVE-2016-1646 HIGH POC

8.8

CVE-2017-5030 HIGH POC

8.8

CVE-2016-4523 HIGH

7.5

CVE-2024-48456 HIGH POC

7.5

CVE-2024-48457 HIGH POC

7.5

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-64209 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64209

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-125 – Out-of-bounds Read

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code