What is the CVSS score of CVE-2026-64558?

CVE-2026-64558 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Linux Kernel are affected by CVE-2026-64558?

CVE-2026-64558 affects IBM Z systems running affected Linux kernel versions, enabling local privilege escalation through memory corruption with high impact to system integrity and data…. A patch is available.

How to fix or mitigate CVE-2026-64558?

Within 24 hours, conduct an asset inventory to identify all IBM Z systems running Linux kernel versions prior to the vendor-released fix and assess current exposure. Within 7 days, coordinate with system administrators to apply the vendor-released patch to all affected systems, conducting testing in non-production environments first. Within 30 days, complete full patch deployment across production and non-production environments, validate system stability post-patching, and update vulnerability management records to reflect remediation status.

Linux Kernel CVE-2026-64558

EUVD-2026-50405 HIGH

2026-07-29 Linux

GHSA-82p5-pf6r-jcxr

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local pkey ioctl access needed (AV:L, PR:L), no user interaction, and an out-of-bounds kernel write yields high C/I/A within an unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

7.0 HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 06:56 vuln.today

CVSS changed

Jul 30, 2026 - 06:37 NVD

7.8 (HIGH)

Patch available

Jul 29, 2026 - 17:02 EUVD

CVE Published

Jul 29, 2026 - 16:31 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 29, 2026 - 16:31 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

s390/pkey: Check length in pkey_pckmo handler implementation

Explicitly check the length of the target buffer in the pkey_pckmo implementation of the key_to_protkey() handler function. The handler function fails, if the generated output data exceeds the length of the provided target buffer.

Articles & Coverage 1

News 3 New Linux Vulnerabilities - 3 High Severity Jul 30, 2026

AnalysisAI

Local privilege-impacting memory corruption in the Linux kernel's s390 (IBM Z) pkey subsystem allows a low-privileged local user to trigger an out-of-bounds write through the pkey_pckmo key_to_protkey() handler, which failed to validate that generated protected-key output fits within the caller-provided target buffer. The flaw affects s390 builds of the kernel prior to the fixed stable releases and carries high confidentiality, integrity, and availability impact (CVSS 7.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the Linux kernel's s390-specific protected-key (pkey) facility, which brokers CPACF/CEX cryptographic protected keys for IBM Z mainframes via a device interface (typically /dev/pkey and associated ioctls). The pkey_pckmo backend implements the key_to_protkey() handler, converting a clear or secure key into a protected key using the PCKMO instruction. The pre-patch code copied generated output into a caller-supplied target buffer without explicitly checking that the produced data length did not exceed that buffer, a classic missing-bounds-check that maps to the out-of-bounds write / improper buffer length validation class (CWE-787 / CWE-120); the upstream CWE field is marked N/A. The fix makes the handler fail cleanly when output would exceed the target length rather than overrunning it.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.12.97 (6.12.x), 6.18.40 (6.18.x), 7.1.5 (7.1.x), or mainline 7.2-rc1 or later - which add the explicit target-buffer length check in the pkey_pckmo key_to_protkey() handler; the corresponding upstream fix commits are at https://git.kernel.org/stable/c/02028a24e26d85262ab9c8fc4344e1f3503007fc, .../433e5e70cdc1edf382d28d08a885b22e2b98b7da, .../614aa0491c7a190556c2345dddee0b6f5ed90989, and .../1ac287e2af9a9112fe271427ef45eceb26bce8b4. Because the bug is only reachable via the s390 pkey interface, an effective compensating control on unpatched systems is to restrict access to the pkey device (tighten permissions/ownership on /dev/pkey so only trusted crypto-management accounts can issue the ioctls) or unload/disable the pkey module where CPACF/CEX protected-key services are not required - the trade-off is that legitimate protected-key crypto workloads on that host will lose access. Non-s390 deployments are not affected and require no action beyond normal kernel currency.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64558 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64558

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

Articles & Coverage 1

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code