What is the CVSS score of CVE-2026-64566?

CVE-2026-64566 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-64566?

A critical memory corruption vulnerability in the Linux kernel's IPsec IPTFS implementation (CVE-2026-64566, CVSS 9.8) can trigger kernel panics on affected systems; no public exploit identified at…. A patch is available.

How to fix or mitigate CVE-2026-64566?

Within 24 hours, inventory all systems running Linux kernel versions 6.14-6.18.41, 7.0.x-7.1.5, or pre-7.2-rc4 and verify which are configured with IPTFS tunnels. Within 7 days, stage kernel upgrades to fixed versions (6.18.42, 7.1.6, 7.2-rc4 or later) on affected infrastructure and test IPTFS tunnel functionality post-upgrade. Within 30 days, complete kernel upgrades on all systems with active IPTFS tunnels.

Linux Kernel CVE-2026-64566

EUVD-2026-53260 CRITICAL

2026-08-05 Linux

GHSA-wr7x-h83j-8fqg

Buffer Overflow Linux

Critical

Disputed · 9.8 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable via a tunnel with no auth (PR:N), but the required nested transport-mode SA plus page-pool shared-frag receive path make it AC:H; memory corruption gives high C/I/A.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 15:25 vuln.today

CVSS changed

Aug 08, 2026 - 15:22 NVD

9.8 (CRITICAL)

Patch available

Aug 05, 2026 - 09:01 EUVD

CVE Published

Aug 05, 2026 - 08:06 cve.org

CRITICAL 9.8

CVE Published

Aug 05, 2026 - 08:06 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()

When iptfs_skb_add_frags() copies frag references from the source frag walk into a new SKB, it increments the page reference count via __skb_frag_ref() but does not propagate SKBFL_SHARED_FRAG to the destination SKB's skb_shinfo->flags.

If the source SKB carries shared frags (e.g. from a page-pool backed receive path), the new inner SKB will appear to ESP as having privately owned frags. A subsequent esp_input() call for a nested transport-mode SA then takes the no-COW fast path and decrypts in place, writing over pages that are still referenced by the outer IPTFS SKB. This causes kernel-visible memory corruption and can trigger a panic.

All other frag-transfer helpers in the kernel (skb_try_coalesce, skb_gro_receive, __pskb_copy_fclone, skb_shift, skb_segment) correctly propagate SKBFL_SHARED_FRAG; align iptfs_skb_add_frags() with this convention by setting the flag inside the loop immediately after __skb_frag_ref() and nr_frags++, so every exit path that attaches a frag unconditionally propagates SKBFL_SHARED_FRAG.

AnalysisAI

Kernel memory corruption in the Linux IPsec IP-TFS/AGGFRAG (xfrm iptfs) receive path allows crafted or normal traffic arriving on an IPTFS tunnel to corrupt kernel memory and panic affected hosts (introduced in Linux 6.14, fixed in 6.18.42, 7.1.6 and 7.2-rc4). Because iptfs_skb_add_frags() fails to propagate the SKBFL_SHARED_FRAG flag when copying page-pool-backed shared frags, a subsequent nested transport-mode esp_input() takes the no-COW fast path and decrypts in place over pages still referenced by the outer SKB. There is no public exploit identified at time of analysis and EPSS is low (0.15%), consistent with the narrow, non-default configuration required.

Technical ContextAI

The flaw lives in the kernel's XFRM/IPsec framework, specifically the IP-TFS (AGGFRAG) tunnel mode implemented in net/xfrm/xfrm_iptfs.c, a Traffic Flow Confidentiality feature added in Linux 6.14. When iptfs_skb_add_frags() reassembles inner packets it borrows page fragment references from the source skb via __skb_frag_ref() and increments nr_frags, but omits setting skb_shinfo->flags |= SKBFL_SHARED_FRAG on the destination skb. SKBFL_SHARED_FRAG is the kernel's marker that a skb's page frags may be shared/owned elsewhere (e.g. a page_pool-backed NIC receive buffer). Every other frag-transfer helper (skb_try_coalesce, skb_gro_receive, __pskb_copy_fclone, skb_shift, skb_segment) preserves this flag; the missing propagation here misleads esp_input() into believing the frags are privately owned, so it decrypts in place (no copy-on-write) and overwrites pages still live in the outer IPTFS skb. The root-cause class is a use-after-free/shared-buffer write, effectively memory corruption (the intel tags it 'Buffer Overflow'); no CWE was assigned in the input.

RemediationAI

Vendor-released patch: upgrade to Linux 6.18.42, 7.1.6, or 7.2-rc4 (or your distribution's backport containing stable commits d8aaf06b29f5a0b6186cf68d21c7d63678ee3891 / ffd64e0717efd83fbf3396ab4e5ac6d795dac4d0 / 430ea57d6daf765e88f90046afbfd1e071cb7200, available at https://git.kernel.org/stable/c/d8aaf06b29f5a0b6186cf68d21c7d63678ee3891). Where immediate patching is not possible, the most direct compensating control is to avoid the vulnerable path: do not deploy IPsec IP-TFS (AGGFRAG) tunnels, and in particular do not stack nested transport-mode ESP SAs inside an IPTFS tunnel, until patched - the trade-off is loss of Traffic Flow Confidentiality for those tunnels. Restricting or tearing down IPTFS SAs via the ip xfrm / strongSwan/libreswan configuration removes exposure entirely on affected kernels; there is no safe in-place tuning of the shared-frag path itself, so patching remains the only complete fix.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected

CVE-2026-64566 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64566

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code