Skip to main content

Linux Kernel CVE-2026-64587

| EUVDEUVD-2026-53774 HIGH
2026-08-06 Linux GHSA-9p7c-hfwg-795w
Information Disclosure Linux Suse
7.0
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local vector required for ARC EMAC hardware access; AC:H for race condition timing dependency; PR:L for local user prerequisite; full CIA impact plausible for kernel heap corruption.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
4.1 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 08, 2026 - 15:37 vuln.today
CVSS changed
Aug 08, 2026 - 15:22 NVD
7.0 (HIGH)
Patch available
Aug 06, 2026 - 08:16 EUVD
CVE Published
Aug 06, 2026 - 07:06 cve.org
HIGH 7.0
CVE Published
Aug 06, 2026 - 07:06 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: arc: emac: quiesce interrupts before requesting IRQ

Normal RX/TX interrupts are enabled later, in arc_emac_open(), so probe should not see interrupt delivery in the usual case. However, hardware may still present stale or latched interrupt status left by firmware or the bootloader.

If probe later unwinds after devm_request_irq() has installed the handler, such a stale interrupt can still reach arc_emac_intr() during teardown and race with release of the associated net_device.

Avoid that window by putting the device into a known quiescent state before requesting the IRQ: disable all EMAC interrupt sources and clear any pending EMAC interrupt status bits. This keeps the change hardware-focused and minimal, while preventing spurious IRQ delivery from leftover state.

AnalysisAI

Race condition in the Linux kernel's ARC EMAC Ethernet driver exposes a use-after-free window during driver probe teardown on ARC processor-based embedded systems. When probe unwinds after devm_request_irq() installs the interrupt handler, stale or firmware-latched EMAC interrupt status bits can fire arc_emac_intr() concurrently with net_device deallocation, potentially corrupting kernel memory. Patched versions are available across all active stable branches (5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.19, 6.19.9, 7.0); no public exploit or CISA KEV entry exists at time of analysis.

Technical ContextAI

The ARC EMAC driver (drivers/net/ethernet/arc/) implements Ethernet support for ARC processor-based SoCs - a niche embedded platform. The vulnerability arises because devm_request_irq() registers the arc_emac_intr() handler before the hardware is placed in a known quiescent state. EMAC hardware may retain latched or stale interrupt status bits set by prior firmware or bootloader activity. If probe subsequently fails and unwinds, those stale bits can trigger the ISR during teardown - racing with the net_device being freed. This is a classic TOCTOU (Time-of-Check to Time-of-Use) race, CWE-362 class, even though the input lists CWE as N/A. The fix is minimal and hardware-focused: disable all EMAC interrupt sources and clear pending status before IRQ registration, closing the window entirely. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covers the affected kernel versions starting from the commit introducing the driver (e4f2379db6c6, Linux 3.11).

RemediationAI

Upgrade to a patched kernel version: 5.10.253 or later in the 5.10 LTS branch, 5.15.203+ in the 5.15 LTS branch, 6.1.167+ in the 6.1 LTS branch, 6.6.130+ in the 6.6 LTS branch, 6.12.78+ in the 6.12 LTS branch, 6.18.19+ in the 6.18 branch, 6.19.9+ in the 6.19 branch, or 7.0. Patches are available directly from the Linux stable tree at https://git.kernel.org/stable/c/abd338da658d7faa8e26cfefc8f83f0066707564 and the sibling commits listed in references. For embedded systems that cannot be immediately updated, blacklisting the arc-emac kernel module (add 'blacklist arc-emac' to /etc/modprobe.d/) prevents driver probe entirely, though this disables all ARC EMAC Ethernet functionality on affected hardware. Given the low EPSS score and hardware-specificity, this fix is appropriate for next scheduled maintenance window rather than emergency patching in most environments.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64587 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy