What is the CVSS score of CVE-2026-64559?

CVE-2026-64559 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Linux Kernel are affected by CVE-2026-64559?

A local information disclosure vulnerability in IBM Z mainframe systems allows low-privileged users with pkey device access to read sensitive kernel memory.. A patch is available.

How to fix or mitigate CVE-2026-64559?

Within 24 hours, inventory all IBM Z (s390x) systems and determine which are running vulnerable Linux kernels. Within 7 days, coordinate with IBM to obtain the patched kernel, test it in non-production environments, and prepare deployment plans. Within 30 days, apply the vendor patch to all production IBM Z systems following change management procedures and verify functionality after patching.

Linux Kernel CVE-2026-64559

EUVD-2026-50406 HIGH

2026-07-29 Linux

GHSA-qvg4-x45w-c5rj

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.6 MEDIUM

Local pkey-device access needed so AV:L/PR:L; vendor tag indicates confidentiality-dominant memory disclosure (C:H) with limited integrity/availability from the out-of-bounds access (I:L/A:L).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 06:58 vuln.today

CVSS changed

Jul 30, 2026 - 06:37 NVD

7.8 (HIGH)

Patch available

Jul 29, 2026 - 17:02 EUVD

CVE Published

Jul 29, 2026 - 16:31 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 29, 2026 - 16:31 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

s390/pkey: Check length in PKEY_VERIFYPROTK ioctl

Explicitly check the buffer length request structure provided by user-space and fail, if it exceeds the buffer size.

Articles & Coverage 1

News 3 New Linux Vulnerabilities - 3 High Severity Jul 30, 2026

AnalysisAI

Local information disclosure in the Linux kernel s390 protected-key (pkey) subsystem affects IBM Z (s390x) mainframe systems where the PKEY_VERIFYPROTK ioctl fails to validate the user-supplied buffer length before processing, allowing a local low-privileged user with access to the pkey device to trigger an out-of-bounds kernel memory access. Fixed by explicitly checking the request length against the buffer size and failing when it exceeds it. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV.

Technical ContextAI

The affected component is the s390/pkey driver in the Linux kernel, which manages 'protected keys' - CPACF-wrapped cryptographic keys used by IBM Z hardware crypto (CEX cards / CPACF). User-space interacts with it through ioctls on the pkey character device; the PKEY_VERIFYPROTK ioctl verifies a protected key blob passed via a request structure that includes a caller-supplied length field. Because the driver did not validate that this length stays within the destination buffer, an oversized value led to an out-of-bounds read/write in kernel space. The upstream advisory carries no assigned CWE, but the behavior maps to the missing-length-validation / out-of-bounds access class (CWE-125 read or CWE-787 write); the 'Information Disclosure' tag indicates confidentiality (kernel memory leak) as the primary practical impact.

RemediationAI

Apply the vendor-released kernel update for your stable branch - patched versions include 6.12.97, 6.18.40, and 7.1.5 (mainline 7.2-rc1) - by rebuilding or installing your distribution's kernel package containing the corresponding stable commit (e.g., 7e7e03848c918aa0acad5ffd75d929e3afec1554), referencing https://git.kernel.org/stable/c/7e7e03848c918aa0acad5ffd75d929e3afec1554 and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-64559. Because exploitation requires access to the pkey device, the most effective interim compensating control is to restrict permissions on the pkey character device so only trusted crypto-service accounts can issue ioctls, and to limit local/interactive access on affected s390x hosts; the trade-off is that legitimate applications relying on protected-key operations must be explicitly granted access. This issue is confined to the s390 architecture, so non-s390 systems require no action.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-64559 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64559

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

Articles & Coverage 1

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code