What is the CVSS score of CVE-2026-64312?

CVE-2026-64312 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64312?

Yes, a patch is available for CVE-2026-64312. Update the affected software to the latest version immediately.

Linux CVE-2026-64312

EUVD-2026-49024 HIGH

2026-07-25 Linux

GHSA-5wjw-79g3-g2x9

Information Disclosure Linux

7.5

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

HIGH

qualitative

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 05:34 vuln.today

CVSS changed

Jul 27, 2026 - 05:22 NVD

7.5 (HIGH)

Patch available

Jul 25, 2026 - 11:18 EUVD

CVE Published

Jul 25, 2026 - 08:49 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 25, 2026 - 08:49 cve.org

HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

crypto: pcrypt - restore callback for non-parallel fallback

pcrypt installs pcrypt_aead_done() on the child AEAD request before trying to submit it through padata. If padata_do_parallel() returns -EBUSY, pcrypt falls back to calling the child AEAD directly.

That fallback must not keep the padata completion callback. Otherwise an asynchronous completion runs pcrypt_aead_done() even though the request was never enrolled in padata.

Restore the original request callback and callback data before calling the child AEAD directly. This keeps the fallback path aligned with a direct AEAD request while leaving the parallel path unchanged.

AnalysisAI

Denial of service in the Linux kernel's pcrypt crypto template allows remote unauthenticated attackers to crash the system by triggering a faulty fallback path. When the parallel execution via padata fails (e.g., due to resource pressure), the pcrypt module does not restore the original callback, leading to unsafe execution of the parallel-only completion routine and kernel memory corruption. The vulnerability has a low EPSS score (0.22%, 13th percentile), no public exploit or active exploitation, and patches are available in multiple stable kernel series.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64312 vulnerability details – vuln.today

Back

Linux CVE-2026-64312

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code