What is the CVSS score of EUVD-2026-45544?

EUVD-2026-45544 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate EUVD-2026-45544?

Within 24 hours, audit your Linux inventory to identify all systems with RDMA/Infiniband functionality enabled and document their current kernel versions. Within 7 days, deploy the vendor-released kernel patch to all affected systems through standard change management, prioritizing systems processing sensitive data or supporting critical services. Within 30 days, confirm full patch deployment across the environment and implement kernel log monitoring for exploitation attempts or memory access anomalies.

Linux Kernel EUVD-2026-45544

Q: Which versions of Linux Kernel are affected by EUVD-2026-45544?

A Linux kernel RDMA subsystem vulnerability (CVE-2026-63860, CVSS 8.4) could allow local actors with RDMA netlink access to crash systems or leak sensitive kernel memory.. A patch is available.

| CVE-2026-63860 HIGH

Improper Null Termination (CWE-170)

2026-07-19 Linux

GHSA-cqch-vjq7-8xrc

Information Disclosure Linux

8.4

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain local RDMA netlink access (CAP_NET_ADMIN)
Exploit

Craft RDMA-core config attribute without NUL terminator
Execution

strcmp()/%s reads past buffer bound
Impact

Leak adjacent kernel memory or crash host

Vulnerability Assessment

Weakness	CWE CWE-170 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Null terminator handling
Exploitation Conditions	Exploitation requires local access to the host and the ability to send configuration commands over the RDMA/InfiniBand core netlink interface, which in practice requires CAP_NET_ADMIN - so this is not exercisable by an unprivileged remote attacker despite the published AV:L/PR:N vector. The concrete prerequisite is a system with the RDMA core (ib_core) loaded and the attacker able to submit a crafted netlink attribute that is a non-NUL-terminated string, causing strcmp()/%s to read past the buffer. Limiting factors: the netlink RDMA path is capability-gated, the module must be present and in use, and hosts without any RDMA/InfiniBand hardware or workload commonly do not load ib_core at all, removing the attack surface entirely.
Impact	The signals are mixed and lean toward low real-world urgency despite the high headline score. The published CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.4) is inconsistent with the described trigger: emitting RDMA-core netlink commands ordinarily requires CAP_NET_ADMIN, so PR:N (no privileges) is almost certainly an over-rating - the practical requirement is a local, capability-holding actor, which materially reduces exposure. EPSS is very low at 0.17% (6th percentile), there is no CISA KEV listing and no public exploit identified, and the vendor tag characterizes the impact as Information Disclosure rather than code execution, consistent with an out-of-bounds read rather than a full C/I/A compromise. Net assessment: a legitimate memory-safety bug worth patching in routine kernel maintenance cycles, but not an emergency - the C:H/I:H/A:H impact triad appears inflated versus a bounded OOB-read whose realistic outcomes are info leak or denial of service. Verify the privilege requirement against your kernel's RDMA netlink permission model before triaging as PR:N.
Exploit ScenarioDerived	A local user or compromised process holding RDMA netlink access (typically CAP_NET_ADMIN) crafts an RDMA-core configuration netlink message whose string attribute deliberately omits the trailing NUL byte. When the kernel passes that attribute to strcmp()/%s, it reads beyond the attribute buffer into adjacent kernel memory, potentially disclosing that data or triggering a crash. No public proof-of-concept has been identified, and the local, capability-gated attack surface keeps practical risk modest.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 20, 2026

Out-of-bounds string handling in the Linux kernel RDMA subsystem (drivers/infiniband/core) allows a local actor with RDMA netlink access to trigger reads past the end of a supplied netlink attribute. The affected code declared configuration attributes as NLA_STRING and then passed them directly to strcmp()/%s formatting without guaranteeing a NUL terminator, so a crafted, unterminated attribute can cause the kernel to read adjacent memory, potentially leaking information or crashing the host. No public exploit identified at time of analysis; the fix simply switches the attributes to NLA_NUL_STRING to enforce termination.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 (or later) on the matching branch - and apply your distribution's backport once available. The upstream fix is available as stable commits on git.kernel.org (e.g. https://git.kernel.org/stable/c/fcd07d3b8ee7a39b344d73aed69c1a68cd9eacdf) and re-declares the affected RDMA netlink attributes as NLA_NUL_STRING. Where immediate patching is not possible, reduce exposure by restricting who can issue RDMA configuration netlink commands - the trigger path is reachable through the RDMA netlink interface, which normally requires CAP_NET_ADMIN, so avoid granting that capability to untrusted local users or containers and unload/blacklist the InfiniBand/RDMA core modules (ib_core and dependents) on systems that do not use RDMA. Trade-off: unloading RDMA modules disables InfiniBand/RoCE/iWARP functionality, so this is only viable on hosts with no RDMA workload; tightening CAP_NET_ADMIN may affect network-management tooling in the same namespace.

Affected VersionsENISA

Linux 3.16

Linux 30dc5e63d6a5ad24894b5512d10b228d73645a44 <fcd07d3b8ee7a39b344d73aed69c1a68cd9eacdf

Linux 30dc5e63d6a5ad24894b5512d10b228d73645a44 <87111356d58d86edb221ba144d261ed83a5b8bbe

Linux 30dc5e63d6a5ad24894b5512d10b228d73645a44 <c26a0052cceed4c4d380ee5808b699f937fb58d8

Linux patch: 0

Linux 30dc5e63d6a5ad24894b5512d10b228d73645a44 <5877c043398d5fa0e93919a3d837e5cd7a98a961

Linux patch: 6.1.175

Linux patch: 7.0.10

Linux 30dc5e63d6a5ad24894b5512d10b228d73645a44 <f2c7b39dde2e61df8157066969cc2a408cd3dcd9

Linux patch: 5.15.209

Linux 30dc5e63d6a5ad24894b5512d10b228d73645a44 <abda65bdd13084c771842adaac1f652d0660dd82

Linux patch: 6.12.91

Linux patch: 5.10.258

Linux patch: 6.18.33

Linux 30dc5e63d6a5ad24894b5512d10b228d73645a44 <6ed3d14fc45d3da6025e7fe4a6a09066856698e2

Linux 30dc5e63d6a5ad24894b5512d10b228d73645a44 <137b5918931d4d05aa8ea8d3adf67f7224eef63c

Linux patch: 7.1

Linux patch: 6.6.141

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability lives in the RDMA/core (InfiniBand core) netlink configuration path. Linux netlink attribute policies distinguish NLA_STRING (a byte blob with no guaranteed trailing NUL) from NLA_NUL_STRING (validated to contain a terminating '\0'). The offending handlers treated NLA_STRING payloads as C strings - feeding them to strcmp() and plain %s printf specifiers - which read until a NUL byte is encountered. If userspace omits the terminator, these routines walk past the attribute buffer boundary, the classic improper null-termination / out-of-bounds read class (CWE-170 / CWE-125). The maintainer's chosen remedy is to re-declare the attributes as NLA_NUL_STRING so the netlink core rejects unterminated input before the string is ever dereferenced. The CPE data identifies the affected component only generically as cpe:2.3:a:linux:linux:*, i.e. the mainline kernel across all listed branches.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.1 HIGH

RDMA netlink access is local and normally needs CAP_NET_ADMIN (PR:L, AV:L); an out-of-bounds read yields info disclosure (C:H) and possible crash (A:H) but no integrity impact (I:N).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE 4.4 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Jul 20, 2026 - 15:22 NVD

8.4 (HIGH)

Patch available

Jul 19, 2026 - 16:19 EUVD

CVE Published

Jul 19, 2026 - 14:04 cve.org

HIGH 8.4

CVE Published

Jul 19, 2026 - 14:04 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Prefer NLA_NUL_STRING

These attributes are evaluated as c-string (passed to strcmp), but NLA_STRING doesn't check for the presence of a \0 terminator.

Either this needs to switch to nla_strcmp() and needs to adjust printf fmt specifier to not use plain %s, or this needs to use NLA_NUL_STRING.

As the code has been this way for long time, it seems to me that userspace does include the terminating nul, even tough its not enforced so far, and thus NLA_NUL_STRING use is the simpler solution.

Executive ViewAI

Why It Matters

A Linux kernel RDMA subsystem vulnerability (CVE-2026-63860, CVSS 8.4) could allow local actors with RDMA netlink access to crash systems or leak sensitive kernel memory. Organizations operating Linux systems with Infiniband/RDMA capabilities face exposure to data exfiltration and service disruption until kernel updates are deployed.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 94% exploitable

Prevalence

Ubiquitous

Linux kernel runs on the vast majority of servers and cloud hosts

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +42

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-170 – Improper Null Termination

View all

CVE-2021-22931 CRITICAL POC

9.8

CVE-2019-11044 HIGH POC

7.5

CVE-2019-11045 MEDIUM POC

5.9

CVE-2022-47515 HIGH POC

7.5

CVE-2025-66220 HIGH POC

7.1

CVE-2021-1411 CRITICAL

9.9

CVE-2026-5067 CRITICAL

9.8

CVE-2026-8721 CRITICAL

9.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back