What is the CVSS score of EUVD-2026-45596?

EUVD-2026-45596 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-45596?

A high-severity privilege escalation vulnerability in the Linux kernel GPIO aggregator driver (CVE-2026-64023, CVSS 7.8) enables local attackers to execute arbitrary code on affected systems, risking…. A patch is available.

How to fix or mitigate EUVD-2026-45596?

Within 24 hours, identify all Linux systems with the GPIO aggregator driver enabled by querying kernel module configurations and boot parameters across your infrastructure. Within 7 days, apply the available vendor patch for the affected Linux kernel to all identified systems, scheduling maintenance windows for reboots as required by your distribution. Within 30 days, validate patch deployment through vulnerability scanning or kernel version auditing, and document remediation completion in your compliance tracking system.

Linux Kernel EUVD-2026-45596

| CVE-2026-64023 HIGH

2026-07-19 Linux

GHSA-pp22-5w4f-hc5v

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local-only kernel UAF (AV:L) triggered by a timing race (AC:H) reachable by a low-privileged user (PR:L); successful exploitation can fully compromise kernel confidentiality, integrity, and availability.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:54 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:39 cve.org

HIGH 7.8

CVE Published

Jul 19, 2026 - 15:39 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

gpio: aggregator: fix a potential use-after-free

On error we free aggr->lookups->dev_id before removing the entry from the lookup table. If a concurrent thread calls gpiod_find() before we remove the entry, it could iterate over the list and call gpiod_match_lookup_table() which unconditionally dereferences dev_id when calling strcmp(). Reverse the order of cleanup.

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel GPIO aggregator driver (gpio-aggregator) arises from a use-after-free on the error-handling path, where aggr->lookups->dev_id is freed before the lookup entry is removed from the table. A concurrent thread calling gpiod_find() can then dereference the freed dev_id via strcmp() in gpiod_match_lookup_table(), yielding a UAF that a low-privileged local attacker could leverage for code execution or DoS. There is no public exploit identified at time of analysis, and EPSS is low (0.17%), consistent with a race-condition kernel bug requiring local access rather than a mass-exploitation candidate.

Technical ContextAI

The flaw lives in the GPIO aggregator, a Linux kernel driver (drivers/gpio/gpio-aggregator.c) that groups GPIO lines from multiple controllers into a single virtual device, typically managed through sysfs (new_device/delete_device). The bug is a classic Use-After-Free (CWE-416): a machine_gpiod_lookup table entry's dev_id string is kfree'd during error cleanup, but the entry is left linked in the global gpio_lookup_list. The kernel's GPIO consumer lookup path, gpiod_find() → gpiod_match_lookup_table(), iterates that list and unconditionally passes dev_id to strcmp(), so any concurrent consumer resolution reads freed heap memory. The fix simply reverses cleanup ordering - unlink the entry from the lookup table before freeing dev_id - closing the race window.

RemediationAI

Apply the vendor-released kernel patch: upgrade to a fixed stable kernel - 6.18.34, 7.0.11, or 7.1 (or your distribution's backported equivalent), corresponding to git.kernel.org stable commits ea28b286649b70618e9dd3e895812417a7712a11, 7ac4183a41ba048af89eddd82fe8be64619d0871, and 30c073cab97afb31901f94de9605177b6b84367e. Where immediate patching is not possible, reduce exposure by preventing untrusted local users from creating/removing GPIO aggregator devices: if the gpio-aggregator module is not required, blacklist/unload it (echo blacklist gpio-aggregator into modprobe.d) - trade-off is loss of any aggregated GPIO functionality; alternatively restrict permissions on the driver's sysfs interfaces (/sys/bus/platform/drivers/gpio-aggregator/) to root only. These controls narrow the race trigger surface but do not eliminate the underlying bug, so patching remains the durable fix.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

EUVD-2026-45596 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-45596

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code