What is the CVSS score of CVE-2026-64221?

CVE-2026-64221 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64221?

Yes, a patch is available for CVE-2026-64221. Update the affected software to the latest version immediately.

Linux CVE-2026-64221

EUVD-2026-48629 HIGH

Use After Free (CWE-416)

2026-07-24 Linux

GHSA-h6qc-gvg6-xmjq

Information Disclosure Linux Use After Free Memory Corruption

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 05:23 vuln.today

CVSS changed

Jul 27, 2026 - 05:22 NVD

7.8 (HIGH)

Patch available

Jul 24, 2026 - 17:48 EUVD

CVE Published

Jul 24, 2026 - 15:23 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 24, 2026 - 15:23 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

spi: ti-qspi: fix use-after-free after DMA setup failure

The driver falls back to PIO mode if DMA setup fails during probe.

Make sure to clear the DMA channel pointer also if buffer allocation fails to avoid passing a pointer to the released channel to the DMA engine (or trying to free the channel a second time on late probe errors or driver unbind).

This issue was flagged by Sashiko when reviewing a devres allocation conversion patch.

AnalysisAI

Local privilege escalation in the Linux kernel's ti-qspi SPI driver results from a use-after-free when DMA setup fails, allowing a local attacker to potentially execute arbitrary code or crash the system. The vulnerability affects Linux kernels from version 4.12 up to the patched stable releases 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No active exploitation has been confirmed (CISA KEV not listed), and the EPSS probability is low (0.18%), indicating limited real-world likelihood.

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2009-4324 HIGH POC

7.8

CVE-2015-0313 CRITICAL POC

9.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2013-2551 HIGH POC

8.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-64221 vulnerability details – vuln.today

Back

Linux CVE-2026-64221

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Same weakness CWE-416 – Use After Free

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code