What is the CVSS score of CVE-2026-64238?

CVE-2026-64238 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-64238?

Yes, a patch is available for CVE-2026-64238. Update the affected software to the latest version immediately.

Linux Kernel CVE-2026-64238

EUVD-2026-48647 MEDIUM

Improper Locking (CWE-667)

2026-07-24 Linux

GHSA-3qfm-27pw-9j46

Information Disclosure Linux Red Hat Suse

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local access with low privileges required to trigger device removal; deadlock produces availability impact only, with no confidentiality or integrity consequences.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

4.7 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 12:09 vuln.today

CVSS changed

Aug 13, 2026 - 12:07 NVD

5.5 (MEDIUM)

Patch available

Jul 24, 2026 - 17:48 EUVD

CVE Published

Jul 24, 2026 - 15:27 nvd

MEDIUM 5.5

CVE Published

Jul 24, 2026 - 15:27 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

gpio: shared: fix deadlock on shared proxy's parent removal

Commit 710abda58055 ("gpio: shared: call gpio_chip::of_xlate() if set") used the mutex embedded in struct gpio_shared_entry to protect the offset field which now can be modified after assignment. The critical section however is too wide and introduced a potential deadlock on the removal of the shared GPIO proxy's parent.

Make the critical section shorter - only protect the offset when it's being read.

While at it: mention the fact that the entry lock is now also used to protect against concurrent access to the offset field in the structure's documentation.

AnalysisAI

Deadlock vulnerability in the Linux kernel's GPIO shared proxy subsystem allows a local, low-privileged user to cause a system hang by triggering removal of a shared GPIO proxy's parent device. The root cause is an overly-wide mutex critical section introduced in commit 710abda58055, where the gpio_shared_entry mutex was held for too long, creating a locking inversion scenario during parent device teardown. No public exploit code exists and no active exploitation has been identified; the fix narrows the critical section to protect only offset reads.

Technical ContextAI

The affected subsystem is the Linux kernel GPIO (General Purpose Input/Output) layer, specifically the shared GPIO proxy mechanism. Commit 710abda58055 ('gpio: shared: call gpio_chip::of_xlate() if set') embedded a mutex in struct gpio_shared_entry to protect the offset field, which becomes mutable post-assignment. CWE-667 (Improper Locking) applies: the critical section was wider than necessary, holding the mutex across operations that could re-acquire the same or a dependent lock during device tree teardown, producing a classic deadlock. Affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* across multiple stable kernel branches including 6.19.x, 7.0.x, and pre-patch 7.1. The fix restricts locking to only the offset read path and updates the structure documentation to reflect the dual-purpose role of the entry lock.

RemediationAI

The vendor-released fix is available via two kernel.org stable commits: a554dfcd30dd5e41d1d67387b3bb85cea83e12e1 (https://git.kernel.org/stable/c/a554dfcd30dd5e41d1d67387b3bb85cea83e12e1) and a1b836607304f71051f9f9dcccf8b5097b86a1fb (https://git.kernel.org/stable/c/a1b836607304f71051f9f9dcccf8b5097b86a1fb). Patched releases are Linux 7.0.12 and Linux 7.1. Ubuntu users should apply USN-8618-1 (https://ubuntu.com/security/notices/USN-8618-1). As a workaround where patching is not immediately feasible, administrators can avoid or defer hot-removal of parent devices associated with shared GPIO proxies, which prevents the deadlock trigger path from being exercised. This workaround has the trade-off of restricting dynamic device management. Systems not using shared GPIO proxy configurations (most general-purpose servers) are not exposed to this code path and do not require urgent prioritization.

Same weakness CWE-667 – Improper Locking

View all

CVE-2025-43510 HIGH POC

7.8

CVE-2019-5886 CRITICAL POC

9.8

CVE-2020-13246 HIGH POC

7.5

CVE-2019-15513 HIGH POC

7.5

CVE-2019-11599 HIGH POC

7.0

CVE-2023-21400 MEDIUM POC

6.7

CVE-2021-20291 MEDIUM POC

6.5

CVE-2026-53049 CRITICAL

9.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-64238 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64238

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-667 – Improper Locking

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code