What is the CVSS score of EUVD-2026-45590?

EUVD-2026-45590 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate EUVD-2026-45590?

Within 24 hours, inventory all Linux systems running kernel versions 6.1.x, 6.5.x, 6.6.x, or 6.7 to determine scope of potential exposure across your infrastructure. Within 7 days, obtain and stage the vendor-released kernel patch from your Linux distribution (Ubuntu LTS, RHEL, Debian, etc.) and begin phased deployment starting with production systems and critical infrastructure. Complete full deployment across all affected systems within 30 days, prioritizing systems with untrusted users or multi-tenant workloads where the privilege escalation impact would be most severe.

Linux Kernel EUVD-2026-45590

Q: Which versions of Linux Kernel are affected by EUVD-2026-45590?

A high-severity local privilege escalation in the Linux kernel's block I/O subsystem (CVE-2026-64017) could allow authorized local users to gain root access on systems running kernel versions 6.1.x…. A patch is available.

| CVE-2026-64017 HIGH

Use After Free (CWE-416)

2026-07-19 Linux

GHSA-pqjq-mhgh-j532

Information Disclosure Linux Use After Free Memory Corruption

7.8

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Recon

Gain local low-privileged access
Delivery

Submit crafted block I/O to blk-mq
Exploit

Force task sleep between peek and pop
Install

Plug flush frees cached request
C2

Reuse dangling cached_rqs pointer
Execute

Corrupt kernel memory
Impact

Escalate to root

Vulnerability Assessment

Weakness	CWE CWE-416 ASVS 5.0 V15 - Secure Coding and Architecture Memory lifecycle management MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires local code execution as an authenticated low-privileged user (CVSS PR:L) who can submit block I/O (bios) through the blk-mq path - i.e., normal filesystem or block-device I/O, available to any local user, no special device access or configuration needed. The decisive limiting factor is the race condition: the attacker must cause the submitting task to sleep at the exact point after peeking a cached request but before popping it, so the plug flush frees cached_rqs first; this timing window is narrow and off the fast path, making reliable triggering difficult. No user interaction and no network access are involved (AV:L, UI:N). Exploitation is further limited to kernels in the affected ranges (mainline ≤6.7 and unpatched 6.1.x/6.5.x/6.6.x stable trees).
Impact	The signals are internally consistent but point to a real-but-not-urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8) marks it as high severity requiring only local, low-privileged access with no user interaction, and full CIA impact consistent with kernel memory corruption that can escalate to root. However, the description makes clear exploitation hinges on a narrow timing window (the task must sleep at a precise point between peek and pop), which argues the published AC:L is optimistic - a more honest reading is AC:H, since an attacker must reliably win a scheduling race to weaponize the UAF. This is corroborated by the very low EPSS of 0.15% (5th percentile), indicating little expectation of near-term mass exploitation. It is NOT in CISA KEV and no POC is referenced. The 'Information Disclosure' tag under-describes the impact: a UAF of a block request structure realistically enables memory corruption and privilege escalation, not merely info leak. Net: patch in normal cycle; not an emergency for most fleets, but relevant for multi-tenant hosts where untrusted local users exist.
Exploit ScenarioDerived	A local unprivileged (but authenticated) user on a shared Linux host runs a program that issues heavy block I/O while deliberately inducing scheduler sleeps to hit the peek-then-sleep-then-pop window, causing the freed cached request to be reused. By grooming the freed slab slot with attacker-controlled data, they corrupt kernel memory to escalate privileges. No public exploit is identified at time of analysis, and success depends on reliably winning the timing race.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 20, 2026

Local privilege-escalation-class memory corruption in the Linux kernel's blk-mq multi-queue block layer allows a local low-privileged user to trigger a use-after-free when submitting a bio: if the task sleeps after peeking a cached request but before popping it, the plug flush frees the cached_rqs, leaving a dangling pointer. The flaw affects mainline and multiple stable trees (6.1.x, 6.5.x, 6.6.x, 6.7) and carries CVSS 7.8 (high CIA impact). There is no public exploit identified at time of analysis, and the very low EPSS (0.15%, 5th percentile) reflects the difficulty of winning the required timing race rather than low structural severity.

RemediationAI

Upstream fix available (stable commits 388468f7e7d1 and dc278e9bf2b9, not a single tagged upstream release), so update to a distribution kernel that has backported these blk-mq patches - apply your distro's latest 6.1.y, 6.6.y, or 6.7+ kernel update and reboot. Reference the fix commits at https://git.kernel.org/stable/c/388468f7e7d1eab092cf2a39fdfb502e52019ec6 and https://git.kernel.org/stable/c/dc278e9bf2b9513a763353e6b9cc21e0f532954e, and monitor your vendor's security tracker (RHSA/USN/SUSE-SU) for the packaged version, which was not enumerated in the provided data. There is no clean feature-flag workaround because plug-based request caching is core to the blk-mq fast path and cannot be disabled without disrupting normal block I/O; the meaningful compensating control is to reduce exposure to untrusted local code - restrict local shell/container access on multi-tenant hosts, and where feasible tighten sandboxing (seccomp/namespaces) around low-trust workloads that issue block I/O. These controls reduce who can attempt the race but do not close the bug, so they are stopgaps pending the kernel update.

Affected VersionsENISA

Linux b5c8e0ff76d10f6bf70a7237678f27c20cf59bc9

Linux 6.6.3 <6.7

Linux patch: 0

Linux 8b6075046470c8756242dfe3fd058813636f69a3

Linux patch: 7.1

Linux 33cf52b6e53a6aa55883aa7fb9ceffceff8488a6

Linux 6.7

Linux 6.5.13 <6.6

Linux 6.6.14 <6.7

Linux 6.1.75 <6.2

Linux patch: 7.0.11

Linux b0077e269f6c152e807fdac90b58caf012cdbaab <388468f7e7d1eab092cf2a39fdfb502e52019ec6

Linux b80056bd75a16e4550873ecefe12bc8fd190b1cf

Linux e9c309ded295b7f8849097d71ae231456ca79f78

Linux 6.1.72 <6.2

Linux b0077e269f6c152e807fdac90b58caf012cdbaab <dc278e9bf2b9513a763353e6b9cc21e0f532954e

Affected Packages

euvd linux fix: 6.2, 6.6, 6.7

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability lives in the Linux block multi-queue (blk-mq) submission path, specifically the plug-based request caching optimization used to batch block I/O. When a bio is submitted, blk-mq may peek a request from the per-task plug cache (cached_rqs) before committing to it. If the submitting task blocks between peeking and popping that request, blk_mq_free_plug_rqs runs during the plug flush and frees the cached request pool, so the subsequent pop operates on freed memory. This is a classic CWE-416 Use-After-Free driven by a race/timing window (the CWE field is listed as N/A in the source, but the described free-then-reuse pattern is textbook UAF). The fix pops the usable cached request before any potentially blocking call, which also holds a queue reference and avoids serialization races with queue freezes; the trade-off is that a plug-merged request must now be freed inline. CPE data identifies the affected component simply as cpe:2.3:a:linux:linux, i.e. the kernel itself, deployed across essentially all Linux distributions.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 7.0 HIGH

Local unprivileged block I/O suffices (AV:L, PR:L), but success requires winning a narrow peek/pop scheduling race, so AC:H; kernel memory corruption yields full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 7.0 HIGH

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:39 cve.org

HIGH 7.8

CVE Published

Jul 19, 2026 - 15:39 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

blk-mq: pop cached request if it is usable

When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blk_mq_free_plug_rqs, freeing the cached_rqs. This creates a use-after-free bug. Fix this by popping the cached request before any possible blocking calls if it is suitable for use.

Popping this request first holds a queue reference, so avoid any serialization races with queue freezes and can safely proceed with dispatching that request to the driver. This potentially increases a timing window from when a driver wants to freeze its queue to when requests stop being dispatched. That scenario is off the fast path though, and drivers need to appropriately handle requests during a freeze request anyway.

The downside is the popped element needs to be individually freed when we performed a bio plug merge. The cached request would have had to be freed later anyway, but this patch does it inline with building the plug list instead of after flushing it.

Executive ViewAI

Why It Matters

A high-severity local privilege escalation in the Linux kernel's block I/O subsystem (CVE-2026-64017) could allow authorized local users to gain root access on systems running kernel versions 6.1.x through 6.7. No public exploit has been identified at time of analysis, and exploitation requires difficult timing conditions (EPSS 0.2%), reducing immediate risk. However, the vulnerability affects widely deployed Linux infrastructure and full system compromise is possible; organizations should prioritize patching to prevent unauthorized privilege escalation.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 95% exploitable

Prevalence

Ubiquitous

Linux kernel block layer, present in virtually all Linux deployments

Data Quality

6 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2009-4324 HIGH POC

7.8

CVE-2015-0313 CRITICAL POC

9.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2013-2551 HIGH POC

8.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-64017 ADVISORY https://seclists.org/oss-sec/2026/q3/230 ADVISORY https://ubuntu.com/security/notices/USN-8593-1 ADVISORY https://vuldb.com/vuln/380174 REF https://git.kernel.org/stable/c/23d8ea1e303b5f32d883757a4a707e791dbc9808 REF https://git.kernel.org/stable/c/388468f7e7d1eab092cf2a39fdfb502e52019ec6 REF https://git.kernel.org/stable/c/97e2d08de282ef76f84ab4ccd00f1acb3f5f999e REF https://git.kernel.org/stable/c/a3fefe65b94b095c9b66420ee0ecabd9fc2e1568 REF https://git.kernel.org/stable/c/dc278e9bf2b9513a763353e6b9cc21e0f532954e REF https://git.kernel.org/stable/c/f122d9968d730c2e71d5e59d0d8b7d67acb5b3bb

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back