What is the CVSS score of CVE-2026-64481?

CVE-2026-64481 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Linux CVE-2026-64481

Q: Which versions of Linux are affected by CVE-2026-64481?

A high-severity flaw in the Linux kernel's cs35l41_hda audio driver (CVE-2026-64481) could allow a local, low-privileged user to escalate privileges and execute arbitrary code, potentially…. A patch is available.

Q: How to fix or mitigate CVE-2026-64481?

Within 24 hours, identify all systems running Linux kernels that include the cs35l41_hda driver (check kernel version and driver module presence). Within 7 days, test and deploy the vendor-released kernel patch (refer to the official Linux kernel stable updates or distribution advisory) to all affected systems, prioritizing high-value assets and multi-user environments. Within 30 days, monitor for signs of exploitation (e.g., unexpected root processes or kernel crashes) and update vulnerability management tools to flag this CVE automatically.

EUVD-2026-48825 HIGH

Use After Free (CWE-416)

2026-07-25 Linux

GHSA-2c47-qrc2-3g99

Information Disclosure Linux Use After Free Memory Corruption

7.8

CVSS 3.1 · Vendor: Linux

View

Vulnerability Assessment

Weakness

CWE

CWE-416

ASVS 5.0

V15 - Secure Coding and Architecture Memory lifecycle management

MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 27, 2026

Local privilege escalation in the Linux kernel’s cs35l41_hda audio driver allows a low-privileged user to corrupt kernel memory and execute arbitrary code. The flaw arises when firmware autostart is disabled and a firmware load work item is queued, then

Affected VersionsENISA

Linux 47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8 <ce0a903d0591e3e2c790c5b628802b08d1b287cc

Linux 6.0

Linux patch: 6.18.39

Linux 47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8 <8947215c0136c9d905e4a46d824824f8b48a2e5b

Linux 47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8 <d6a40a4d083ef74d00c8f9516cb5ff07ac70720b

Linux patch: 0

Linux patch: 7.2-rc1

Linux patch: 6.12.97

Linux 47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8 <b65020d5398f499c09498c9786dba6d67ae57664

Linux patch: 7.1.4

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SUSE HIGH

Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Jul 27, 2026 - 05:22 NVD

7.8 (HIGH)

Patch available

Jul 25, 2026 - 11:18 EUVD

CVE Published

Jul 25, 2026 - 08:51 cve.org

HIGH 7.8

CVE Published

Jul 25, 2026 - 08:51 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda/cs35l41: Fix firmware load work teardown

cs35l41_hda creates ALSA controls whose private data points at the cs35l41_hda object. The firmware load control can also queue fw_load_work.

Those controls are not removed on component unbind, and device remove only cancels fw_load_work through cs35l41_remove_dsp(). That helper is skipped when halo_initialized is false. With firmware_autostart disabled, a firmware load can be requested before the DSP has been initialized. If the component or device is removed before the queued work runs, the worker can run after teardown and dereference driver state that is no longer valid.

Track the created controls and remove them on unbind so no new control callback can reach the driver data or queue more work. Then cancel fw_load_work to drain any request that was already queued. Also cancel the work unconditionally during device remove before runtime PM teardown.

Executive ViewAI

Why It Matters

A high-severity flaw in the Linux kernel's cs35l41_hda audio driver (CVE-2026-64481) could allow a local, low-privileged user to escalate privileges and execute arbitrary code, potentially compromising system integrity and data confidentiality. This vulnerability affects all Linux-based systems using affected kernel versions, including servers, workstations, and embedded devices. Leadership should prioritize patching to prevent local attackers from gaining full control of affected systems.

Recommended Action

Within 24 hours, identify all systems running Linux kernels that include the cs35l41_hda driver (check kernel version and driver module presence). Within 7 days, test and deploy the vendor-released kernel patch (refer to the official Linux kernel stable updates or distribution advisory) to all affected systems, prioritizing high-value assets and multi-user environments. Within 30 days, monitor for signs of exploitation (e.g., unexpected root processes or kernel crashes) and update vulnerability management tools to flag this CVE automatically.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 89% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2009-4324 HIGH POC

7.8

CVE-2015-0313 CRITICAL POC

9.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2013-2551 HIGH POC

8.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-64481 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/383276 REF https://git.kernel.org/stable/c/3e339c88b8c3044919fd1936a8b23124285d0de6 REF https://git.kernel.org/stable/c/8947215c0136c9d905e4a46d824824f8b48a2e5b REF https://git.kernel.org/stable/c/b3647e5b7b817272fdef057948c37fcb0704edc7 REF https://git.kernel.org/stable/c/b65020d5398f499c09498c9786dba6d67ae57664 REF https://git.kernel.org/stable/c/ce0a903d0591e3e2c790c5b628802b08d1b287cc REF https://git.kernel.org/stable/c/d6a40a4d083ef74d00c8f9516cb5ff07ac70720b

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back