What is the CVSS score of CVE-2026-64599?

CVE-2026-64599 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-64599?

CVE-2026-64599 is a Linux kernel privilege escalation vulnerability affecting devices with Amlogic GXL crypto hardware (set-top boxes, smart TVs, and Android-based devices) with no public exploit…. A patch is available.

How to fix or mitigate CVE-2026-64599?

Within 24 hours, identify all systems running affected Linux kernel versions 5.5 through current stable branches with Amlogic GXL hardware support enabled, and assess whether these systems are present in your infrastructure. Within 7 days, obtain the vendor-released patch for your kernel branch and test it in a non-production environment to confirm compatibility with your device configurations. Within 30 days, deploy the patched kernel to all affected production systems, prioritizing any systems with network exposure or multi-user access capabilities.

Linux Kernel CVE-2026-64599

EUVD-2026-53786 HIGH

2026-08-06 Linux

GHSA-j4fc-xrx5-phgr

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

AC:H because exploitation requires deliberately inducing DMA allocation failure during a narrow probe window, not a reliably reproducible condition under normal operation.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 08, 2026 - 15:40 vuln.today

CVSS changed

Aug 08, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Aug 06, 2026 - 08:16 EUVD

CVE Published

Aug 06, 2026 - 07:13 cve.org

HIGH 7.8

CVE Published

Aug 06, 2026 - 07:13 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

crypto: amlogic - avoid double cleanup in meson_crypto_probe()

When meson_allocate_chanlist() fails after a partial allocation, it already unwinds the allocated chanlist state through its local error path. meson_crypto_probe() then jump to error_flow and calls meson_free_chanlist() again, causing the same per-flow resources to be torn down twice. In the reproduced failure path, the second teardown re-entered crypto_engine_exit() on an already destroyed worker and KASAN reported a slab-use-after-free in kthread_destroy_worker().

Prevent double-free by handling partial allocation failures locally within meson_allocate_chanlist() and skipping the outer cleanup path.

The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available.

The bug was reproduced in a QEMU x86_64 guest booted with KASAN on v7.1, using the reproducer under tools/testing/meson_crypto_probe. The reproducer forces the second dma_alloc_attrs() call in the gxl-crypto probe path to return NULL, making meson_allocate_chanlist() fail after partial initialization. On the unpatched kernel this reliably triggered a slab-use-after-free. With this fix applied, the same reproducer no longer emits any KASAN report and the probe fails cleanly with -ENOMEM.

============== BUG: KASAN: slab-use-after-free in kthread_destroy_worker+0xb2/0xd0 Read of size 8 at addr ff1100010c057a68 by task insmod/265

CPU: 1 UID: 0 PID: 265 Comm: insmod Tainted: G O 7.1.0-rc2-00376-g810af9adc907-dirty #10 PREEMPT(lazy) Tainted: [O]=OOT_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x68/0xa0 print_report+0xcb/0x5e0 ? __virt_addr_valid+0x21d/0x3f0 ? kthread_destroy_worker+0xb2/0xd0 ? kthread_destroy_worker+0xb2/0xd0 kasan_report+0xca/0x100 ? kthread_destroy_worker+0xb2/0xd0 kthread_destroy_worker+0xb2/0xd0 meson_crypto_probe+0x4d0/0xc10 [amlogic_gxl_crypto] platform_probe+0x99/0x140 really_probe+0x1c6/0x6a0 ? __pfx___device_attach_driver+0x10/0x10 __driver_probe_device+0x248/0x310 ? acpi_driver_match_device+0xb0/0x100 driver_probe_device+0x48/0x210 ? __pfx___device_attach_driver+0x10/0x10 __device_attach_driver+0x160/0x320 bus_for_each_drv+0x104/0x190 ? __pfx_bus_for_each_drv+0x10/0x10 ? _raw_spin_unlock_irqrestore+0x2c/0x50 __device_attach+0x19d/0x3b0 ? __pfx___device_attach+0x10/0x10 ? do_raw_spin_unlock+0x53/0x220 device_initial_probe+0x78/0xa0 bus_probe_device+0x5b/0x130 device_add+0xcfd/0x1430 ? __pfx_device_add+0x10/0x10 ? insert_resource+0x34/0x50 ? lock_release+0xc9/0x290 platform_device_add+0x24e/0x590 ? __pfx_meson_crypto_probe_repro_init+0x10/0x10 [meson_crypto_probe_repro] meson_crypto_probe_repro_init+0x330/0xff0 [meson_crypto_probe_repro] do_one_initcall+0xc0/0x450 ? __pfx_do_one_initcall+0x10/0x10 ? _raw_spin_unlock_irqrestore+0x2c/0x50 ? __create_object+0x59/0x80 ? kasan_unpoison+0x27/0x60 do_init_module+0x27b/0x7d0 ? __pfx_do_init_module+0x10/0x10 ? kasan_quarantine_put+0x84/0x1d0 ? kfree+0x32c/0x510 ? load_module+0x561e/0x5ff0 load_module+0x54fe/0x5ff0 ? __pfx_load_module+0x10/0x10 ? security_file_permission+0x20/0x40 ? kernel_read_file+0x23d/0x6e0 ? mmap_region+0x235/0x4a0 ? __pfx_kernel_read_file+0x10/0x10 ? __file_has_perm+0x2c0/0x3e0 init_module_from_file+0x158/0x180 ? __pfx_init_module_from_file+0x10/0x10 ? __lock_acquire+0x45a/0x1ba0 ? idempotent_init_module+0x315/0x610 ? lock_release+0xc9/0x290 ? lock ---truncated---

AnalysisAI

Use-after-free in the Linux kernel's Amlogic GXL crypto driver (crypto/amlogic) allows a local attacker to trigger memory corruption during driver probe failure, potentially enabling privilege escalation or denial of service on affected kernels (5.5 through pre-patch stable branches). The double-cleanup defect in meson_crypto_probe() causes meson_free_chanlist() to tear down already-freed per-flow resources - confirmed via KASAN slab-use-after-free in kthread_destroy_worker() - when meson_allocate_chanlist() fails after partial initialization. No public exploit identified at time of analysis; EPSS is 0.16% (6th percentile), consistent with the narrow hardware footprint and non-trivial triggering conditions.

Technical ContextAI

The vulnerable code resides in drivers/crypto/amlogic/amlogic-gxl-core.c, the probe function for Amlogic/Meson GXL hardware crypto accelerators (CPE: cpe:2.3:a:linux:linux). When meson_allocate_chanlist() encounters a failure mid-allocation (e.g., the second dma_alloc_attrs() returning NULL), it partially unwinds per-channel state internally via its own local error path, including calling crypto_engine_exit() on any already-initialized crypto engine workers. Control then returns to the outer meson_crypto_probe() error path, which unconditionally jumps to error_flow and calls meson_free_chanlist() again - re-entering crypto_engine_exit() and kthread_destroy_worker() on an already-destroyed kthread worker object. This constitutes a classic double-free / use-after-free pattern (analogous to CWE-415/CWE-416); no CWE was formally assigned by NVD. KASAN catch confirmed on v7.1 under QEMU x86_64 with the reproducer forcing the second DMA allocation to fail. The fix restructures error handling so partial allocation failures are absorbed entirely within meson_allocate_chanlist(), preventing the outer cleanup from re-processing already-freed resources.

RemediationAI

The primary fix is to update the Linux kernel to a patched stable branch: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, or 7.2-rc1 as appropriate for the running kernel series, sourced from https://git.kernel.org/stable. Distribution maintainers (Debian, Ubuntu, RHEL, etc.) will backport these fixes into their respective kernel packages; check vendor advisories for distro-specific patch versions. If an immediate kernel update is not feasible and the system uses Amlogic GXL crypto hardware, a targeted workaround is to blacklist or prevent autoloading of the amlogic_gxl_crypto kernel module (e.g., add blacklist amlogic_gxl_crypto to /etc/modprobe.d/blacklist.conf and run dracut -f), which eliminates the attack surface entirely but disables hardware crypto acceleration on the Amlogic SoC - software-fallback crypto will remain functional with minor throughput impact. On general-purpose servers and workstations not shipping Amlogic hardware, this driver is not present and no action is required.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected

CVE-2026-64599 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64599

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code