What is the CVSS score of EUVD-2026-45642?

EUVD-2026-45642 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by EUVD-2026-45642?

CVE-2026-64069 is a critical memory management vulnerability in the Linux kernel's network filesystem subsystem (netfslib), affecting CIFS/SMB, AFS, Ceph, and 9p clients used for enterprise storage…. A patch is available.

How to fix or mitigate EUVD-2026-45642?

Within 24 hours, inventory all production Linux systems running network filesystem clients (CIFS/SMB, AFS, Ceph, 9p) and identify kernel versions subject to CVE-2026-64069 using vulnerability scanning or kernel audit tools. Within 7 days, deploy the vendor-released patch to all identified systems via standard Linux update channels, prioritizing those handling authentication, critical data, or business-essential services. Within 30 days, verify patch deployment across the infrastructure using kernel version attestation, document completion for compliance records, and conduct post-patch monitoring for anomalies in filesystem performance or availability.

Linux Kernel EUVD-2026-45642

| CVE-2026-64069 CRITICAL

Out-of-bounds Read (CWE-125)

2026-07-19 Linux

GHSA-95rq-8wg2-8c57

Buffer Overflow Information Disclosure Linux

Critical

Disputed · 9.8 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.3 MEDIUM

Reachable only locally via a netfs mount and an uncommon read-prep failure (AV:L, AC:H, PR:L); most likely outcome is a crash (A:H) with possible limited info leak (C:L).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:14 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

9.8 (CRITICAL)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:39 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:39 cve.org

CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfs: Fix cancellation of a DIO and single read subrequests

When the preparation of a new subrequest for a read fails, if the subrequest has already been added to the stream->subrequests list, it can't simply be put and abandoned as the collector may see it. Also, if it hasn't been queued yet, it has two outstanding refs that both need to be put. Both DIO read and single-read dispatch fail at this; further, both differ in the order they do things to the way buffered read works.

Fix cancellation of both DIO-read and single-read subrequests that failed preparation by the following steps:

(1) Harmonise all three reads (buffered, dio, single) to queue the subreq before prepping it.

(2) Make all three call netfs_queue_read() to do the queuing.

(3) Set NETFS_RREQ_ALL_QUEUED independently of the queuing as we don't know the length of the subreq at this point.

(4) In all cases, set the error and NETFS_SREQ_FAILED flag on the subreq and then call netfs_read_subreq_terminated() to deal with it. This will pass responsibility off to the collector for dealing with it.

AnalysisAI

Improper error-path cleanup in the Linux kernel's netfs read subsystem (the netfslib helper used by network filesystem clients such as CIFS/SMB, AFS, Ceph and 9p) mishandles reference counting when preparation of a direct-I/O (DIO) or single-read subrequest fails after being added to the stream's subrequest list. Because the failed subrequest can still be observed by the collector while holding two outstanding references, this leads to reference mismanagement and potential use-after-free/memory disorder on the read failure path, tagged as an information-disclosure risk. The fix has been merged upstream and backported; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.17%).

Technical ContextAI

The affected component is netfslib (fs/netfs), the shared read/write helper library the Linux kernel provides to network and caching filesystems (CIFS/SMB3, AFS, Ceph, 9p, and fscache-backed mounts). During a read, netfs splits the operation into subrequests attached to a per-request stream list; when the preparation of a new DIO-read or single-read subrequest fails, the code previously either put-and-abandoned a subrequest the collector could still see, or leaked two outstanding references when the subrequest had not yet been queued. The root cause is a lifecycle/reference-counting error on an error path (a CWE-416 use-after-free / CWE-672 operate-on-resource-after-expiration class issue; NVD lists CWE as N/A). The fix harmonises buffered, DIO and single reads to queue the subrequest before prepping it, routes all queuing through netfs_queue_read(), sets NETFS_RREQ_ALL_QUEUED independently, and on failure sets NETFS_SREQ_FAILED plus the error and calls netfs_read_subreq_terminated() so the collector owns teardown. CPE data (cpe:2.3:a:linux:linux) identifies the affected product only as the Linux kernel without precise version boundaries.

RemediationAI

Vendor-released patch: update to Linux kernel 6.18.34, 7.0.11, or 7.1 (or later), or apply your distribution's backport containing stable commits 5366199be46f / 6f0f7ac1915a / f73372a4c690 referenced at git.kernel.org. Distribution kernels (RHEL, Ubuntu, SUSE, Debian) should be patched via normal vendor updates and the host rebooted (or live-patched where available) to load the corrected netfs code. If immediate patching is not possible, the only meaningful compensating control is to reduce use of the vulnerable path: avoid or unmount netfs-backed network filesystems (CIFS/SMB, AFS, Ceph, 9p) and fscache on unpatched hosts, and avoid direct-I/O read workloads against them - the trade-off is loss of those network-filesystem services, so this is only viable where such mounts are non-essential. There is no configuration flag that disables the specific error path, so upgrading the kernel is the definitive remedy.

Same weakness CWE-125 – Out-of-bounds Read

View all

CVE-2014-0160 HIGH POC

7.5

CVE-2016-5198 HIGH POC

8.8

CVE-2025-5777 CRITICAL POC

9.3

CVE-2016-1646 HIGH POC

8.8

CVE-2017-5030 HIGH POC

8.8

CVE-2016-4523 HIGH

7.5

CVE-2024-48456 HIGH POC

7.5

CVE-2024-48457 HIGH POC

7.5

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

EUVD-2026-45642 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-45642

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-125 – Out-of-bounds Read

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code