What is the CVSS score of CVE-2026-64243?

CVE-2026-64243 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64243?

Yes, a patch is available for CVE-2026-64243. Update the affected software to the latest version immediately.

Linux CVE-2026-64243

EUVD-2026-48652 HIGH

Improper Validation of Array Index (CWE-129)

2026-07-24 Linux

GHSA-g8x3-7685-9cvh

Information Disclosure Linux

7.1

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

SUSE

HIGH

qualitative

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 05:25 vuln.today

CVSS changed

Jul 27, 2026 - 05:22 NVD

7.1 (HIGH)

Patch available

Jul 24, 2026 - 17:48 EUVD

CVE Published

Jul 24, 2026 - 15:27 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 24, 2026 - 15:27 cve.org

HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ASoC: codecs: simple-mux: Fix enum control bounds check

simple_mux_control_put() rejects values greater than e->items, but enum control values are zero based. For the two-entry mux used by this driver, valid values are 0 and 1, so value 2 must be rejected as well.

Accepting e->items can store an invalid mux state, pass it to the GPIO setter, and pass it on to the DAPM mux update path where it is used as an index into the enum text array.

Use the same >= e->items check used by the ASoC enum helpers.

AnalysisAI

Improper bounds checking in the Linux kernel's ASoC simple-mux driver allows a local attacker with low privileges to cause an out-of-bounds array index, leading to kernel memory disclosure and system crash. The driver erroneously accepts the maximum enum value (2) as valid for a two-entry mux, enabling an invalid mux state to propagate into GPIO and DAPM operations. Vendor patches are available for affected stable kernels, and no public exploit or active exploitation is known at this time.

Same weakness CWE-129 – Improper Validation of Array Index

View all

CVE-2016-9053 CRITICAL POC

9.8

CVE-2020-27485 CRITICAL POC

9.9

CVE-2020-27483 CRITICAL POC

9.9

CVE-2024-24563 CRITICAL POC

9.8

CVE-2017-8797 HIGH

7.5

CVE-2018-11489 HIGH POC

8.8

CVE-2026-56770 HIGH POC

8.7

CVE-2017-7228 HIGH POC

8.2

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64243 vulnerability details – vuln.today

Back

Linux CVE-2026-64243

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Same weakness CWE-129 – Improper Validation of Array Index

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code