What is the CVSS score of CVE-2026-64547?

CVE-2026-64547 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-64547?

Linux systems running the net1080 USB driver face a high-severity vulnerability (CVE-2026-64547) enabling memory disclosure if a malicious USB device connects to affected systems.. A patch is available.

How to fix or mitigate CVE-2026-64547?

Within 24 hours, identify Linux systems using the net1080 USB driver and assess physical security controls around USB port access to quantify exposure. Within 7 days, apply the vendor-released kernel patch from your Linux distribution vendor (Red Hat, Canonical, Debian, etc.) to all affected systems; contact your distribution for the specific patched kernel version applicable to your deployment. Within 30 days, verify patch deployment across all Linux systems through automated asset inventory tools and confirm kernel version updates to close the vulnerability.

Linux Kernel CVE-2026-64547

EUVD-2026-49598 HIGH

2026-07-27 Linux

GHSA-wxqx-m575-fh25

Buffer Overflow Linux

8.1

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.1 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

5.2 MEDIUM

Requires an attacker-controlled NetChip 1080 USB device physically present (AV:P), no auth (PR:N); single-byte OOB read gives limited disclosure (C:L) and a likely panic (A:H).

3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

4.0 AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

4.6 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 06:51 vuln.today

CVSS changed

Jul 30, 2026 - 06:37 NVD

8.1 (HIGH)

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:10 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 27, 2026 - 20:10 cve.org

HIGH 8.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: usb: net1080: validate packet_len before pad-byte access in rx_fixup

For an even packet_len, net1080_rx_fixup() reads the pad byte at skb->data[packet_len] before the skb->len != packet_len check further down, and packet_len is only bounded against NC_MAX_PACKET. A malicious NetChip 1080 device can send a short frame advertising a large even packet_len (e.g. 0x4000), so the pad-byte read lands past the end of the skb:

BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14 ... net1080_rx_fixup (drivers/net/usb/net1080.c:384) usbnet_bh (drivers/net/usb/usbnet.c:1589) process_one_work (kernel/workqueue.c:3322) bh_worker (kernel/workqueue.c:3708) tasklet_action (kernel/softirq.c:965) handle_softirqs (kernel/softirq.c:622) ...

Reject the frame when packet_len >= skb->len before reading.

AnalysisAI

Out-of-bounds read in the Linux kernel's net1080 USB networking driver allows a malicious NetChip 1080 (NC1080) USB device to read slab memory past the end of a socket buffer during RX processing. In net1080_rx_fixup(), an even attacker-controlled packet_len is used to index a pad byte (skb->data[packet_len]) before it is validated against the actual frame length, so a short frame advertising a large even packet_len (e.g. 0x4000, bounded only by NC_MAX_PACKET) triggers a KASAN slab-out-of-bounds read in softirq/ksoftirqd context. This is a vendor-fixed kernel hardening bug with no public exploit identified at time of analysis; EPSS is low (0.18%) and it is not in CISA KEV.

Technical ContextAI

The affected component is drivers/net/usb/net1080.c, the usbnet mini-driver for the NetChip 1080 USB-to-USB host-to-host networking bridge, which runs on top of the shared usbnet framework (usbnet_bh -> net1080_rx_fixup). The driver's rx_fixup routine parses a NetChip framing header to recover packet_len and, for even lengths, inspects a trailing pad byte. The root cause is a classic CWE-125 out-of-bounds read (the input tags label this 'Buffer Overflow'): packet_len is bounded only against NC_MAX_PACKET and the pad byte at skb->data[packet_len] is dereferenced before the skb->len != packet_len sanity check executes, so a device-supplied length larger than the buffer indexes past the allocated slab object. The fix reorders validation to reject frames where packet_len >= skb->len before any pad-byte access.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or mainline >= 7.2-rc3 (or your distribution's kernel that backports the corresponding git.kernel.org/stable/c/ commit such as f42217fa7d53 or 685e92934f11) - which adds the packet_len >= skb->len check before the pad-byte read. Where immediate patching is not possible, the highest-impact compensating control is to prevent the vulnerable driver from binding: blacklist/unload the net1080 module (e.g. an /etc/modprobe.d entry with 'blacklist net1080' plus 'install net1080 /bin/false'), which fully removes exposure at the cost of losing NetChip 1080 host-to-host bridge functionality (a feature almost no production system uses). Additionally enforce USB device authorization / USBGuard policies or disable untrusted USB ports so attacker-supplied USB NICs cannot enumerate, accepting the operational trade-off of managing an allowlist for legitimate USB peripherals. Confirm the exact fixed version against your distribution's advisory before deploying.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-64547 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64547

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code