What is the CVSS score of CVE-2026-64282?

CVE-2026-64282 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64282?

Yes, a patch is available for CVE-2026-64282. Update the affected software to the latest version immediately.

Linux Kernel CVE-2026-64282

EUVD-2026-48994 MEDIUM

Race Condition (CWE-362)

2026-07-25 Linux

GHSA-rvp6-qppr-rmf4

Linux Information Disclosure Race Condition

4.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.7 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.7 MEDIUM

Local vector and high complexity reflect the arm64/KVM prerequisite and race-condition timing; PR:L for /dev/kvm access; only availability impacted via memory exhaustion.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 16:18 vuln.today

CVSS changed

Aug 13, 2026 - 15:52 NVD

4.7 (MEDIUM)

Patch available

Jul 25, 2026 - 11:18 EUVD

CVE Published

Jul 25, 2026 - 08:49 nvd

MEDIUM 4.7

CVE Published

Jul 25, 2026 - 08:49 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier

In the case that kvm_translate_vncr() races with an MMU notifier the early return does not release a reference on the faulted in PFN. Add the necessary call to kvm_release_faultin_page() for the unused PFN.

AnalysisAI

KVM arm64 in the Linux kernel leaks a Page Frame Number reference when kvm_translate_vncr() races an MMU notifier, allowing a local low-privileged attacker to gradually exhaust kernel memory and cause a denial of service on affected arm64 hypervisor hosts. The vulnerability is specific to arm64 systems running KVM with VNCR (Virtualization Non-Cached Region) active, and requires precise race-condition timing (AC:H). No public exploit has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) confirms this remains a low-probability exploitation target.

Technical ContextAI

The affected component is the KVM (Kernel-based Virtual Machine) hypervisor subsystem in the Linux kernel, restricted to the arm64 architecture implementation. The function kvm_translate_vncr() handles page-fault-driven translation of VNCR pages used in ARM virtualization extensions. When the kernel's MMU notifier fires concurrently during this operation, an early error-return path exits without calling kvm_release_faultin_page() to drop the reference on the PFN (Page Frame Number) that was faulted in. This constitutes a reference count leak rather than a traditional memory disclosure. CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) is the root cause class - the race between the page-fault handler and the MMU invalidation callback is not properly handled in all code paths. CPE data (cpe:2.3:a:linux:linux) covers the full Linux kernel product, though only arm64 KVM deployments reach the vulnerable code path.

RemediationAI

Upgrade the Linux kernel to a patched stable release: 6.18.39, 7.1.4, or 7.2-rc1 (or any subsequent release in those series). The three upstream fix commits are available at https://git.kernel.org/stable/c/0c93681aea0a1b8be14730a88abe77c840272e41, https://git.kernel.org/stable/c/cd1067ccc0dbc18890a74db116d00a4bc3c7f2f7, and https://git.kernel.org/stable/c/9f76b039a72d7e06374aa96862f0232ed53f7787. Linux distribution vendors (Red Hat, Ubuntu, SUSE, Debian) will backport these fixes to their supported kernel versions; consult the relevant distribution security advisory for confirmed package versions. As a compensating control on systems where immediate patching is not feasible, restricting access to /dev/kvm to only authorized users reduces the pool of potential attackers, since exploitation requires PR:L per the CVSS vector. Systems not running KVM virtualization on arm64 are not exposed to this code path and require no urgent action. Note that restricting /dev/kvm access may break legitimate virtualization workloads and should be evaluated against operational requirements.

Same weakness CWE-362 – Race Condition

View all

CVE-2023-36884 HIGH POC

7.5

CVE-2016-5195 HIGH POC

7.0

CVE-2017-1000112 HIGH POC

7.0

CVE-2014-0196 MEDIUM POC

5.5

CVE-2014-0226 MEDIUM POC

6.8

CVE-2016-1757 HIGH POC

7.0

CVE-2016-8655 HIGH POC

7.8

CVE-2015-5754 CRITICAL POC

9.3

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected

CVE-2026-64282 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64282

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-362 – Race Condition

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code