What is the CVSS score of CVE-2026-64212?

CVE-2026-64212 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64212?

Yes, a patch is available for CVE-2026-64212. Update the affected software to the latest version immediately.

Linux Kernel CVE-2026-64212

EUVD-2026-48620 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-07-24 Linux

GHSA-f3qr-xjfh-cqgx

Denial Of Service Linux Null Pointer Dereference Red Hat Suse

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local vector with low privileges matches a local DoS via kernel panic; no confidentiality or integrity impact applies.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 22:31 vuln.today

CVSS changed

Aug 11, 2026 - 17:37 NVD

5.5 (MEDIUM)

Patch available

Jul 24, 2026 - 17:48 EUVD

CVE Published

Jul 24, 2026 - 15:23 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 24, 2026 - 15:23 nvd

MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it

In iwl_mld_remove_link, the link->fw_id is saved at the beginning of the function so we have it after we freed the link.

But the link pointer can be NULL, and is not checked when the fw_id is stored.

Fix it by simply freeing the link at the end of the function.

fFixes: 0e66a39f4f0e ("wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link()")

AnalysisAI

NULL pointer dereference in the Linux kernel's iwlwifi MLD (Multi-Link Device) Wi-Fi driver allows a local low-privileged user to crash the kernel, resulting in a denial-of-service condition. The flaw resides in iwl_mld_remove_link, where the link->fw_id field is read before the link pointer is validated for NULL, enabling a kernel panic on affected systems with Intel wireless hardware. No public exploit code exists and the vulnerability is not listed in CISA KEV; patches are available in stable kernel releases 6.18.34, 7.0.11, and 7.1.

Technical ContextAI

The affected code is in the iwlwifi MLD subsystem of the Linux kernel (CWE-476: NULL Pointer Dereference). The iwl_mld_remove_link function was modified by a prior fix (commit 0e66a39f4f0e) to save link->fw_id at function entry so the value remains accessible after the link structure is freed. However, that modification introduced a regression: the dereference of link->fw_id now occurs before the NULL check on the link pointer itself, meaning if link is NULL the kernel immediately panics. The fix restructures the function to free the link at the end, eliminating the early dereference. Affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covering mainline and stable branches through 6.18.33 and 7.0.10. The iwlwifi MLD driver specifically targets Intel Wi-Fi 7 hardware supporting IEEE 802.11be Multi-Link Operation.

RemediationAI

The primary fix is to upgrade the Linux kernel to version 6.18.34, 7.0.11, or 7.1, which contain the corrected iwl_mld_remove_link implementation. The upstream fix commits are available at https://git.kernel.org/stable/c/3a74aaad047353da3344aed32e9042d4f334f926, https://git.kernel.org/stable/c/b6b4db85c7baf0788c5e7ec61350c1ff2bb775e0, and https://git.kernel.org/stable/c/d733ed481fd20a8e7bfe5119c4e77761ba3f87ee. Ubuntu users should apply the packages referenced in USN-8618-1 at https://ubuntu.com/security/notices/USN-8618-1. As a compensating control where patching is not immediately possible, systems with Intel Wi-Fi 7 MLD hardware could blacklist the iwlwifi module (modprobe -r iwlwifi) to prevent the driver from loading, at the cost of losing wireless connectivity. Restricting local user access on sensitive systems (limiting shell accounts) reduces the attack surface but does not eliminate it.

Same weakness CWE-476 – NULL Pointer Dereference

View all

CVE-2016-0742 HIGH

7.5

CVE-2014-3470 MEDIUM

4.3

CVE-2017-3730 HIGH POC

7.5

CVE-2017-3169 CRITICAL POC

9.8

CVE-2016-4957 HIGH

7.5

CVE-2015-3194 HIGH

7.5

CVE-2026-21525 MEDIUM

6.2

CVE-2017-0016 MEDIUM

5.9

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-64212 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64212

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-476 – NULL Pointer Dereference

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code