What is the CVSS score of EUVD-2026-45703?

EUVD-2026-45703 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-45703?

A high-severity local privilege escalation vulnerability in Linux kernel Industrial I/O buffer handling could allow attackers with local access to escalate privileges and corrupt system memory.. A patch is available.

How to fix or mitigate EUVD-2026-45703?

Within 24 hours, identify all Linux systems running IIO buffer subsystem components-typically embedded Linux systems, manufacturing controllers, and specialized industrial equipment-and audit current kernel versions against vendor security advisories. Within 7 days, procure the patched kernel from your Linux distribution maintainer or hardware vendor, stage the update in a controlled maintenance window, and validate compatibility with dependent IIO applications. Within 30 days, deploy the patched kernel across all affected production systems and execute post-deployment functional tests on IIO subsystems to confirm continued operation and absence of regression.

Linux Kernel EUVD-2026-45703

| CVE-2026-63930 HIGH

2026-07-19 Linux

GHSA-ggvg-29pg-f22f

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local access with low privileges (AV:L/PR:L), but AC:H because the bug only triggers on an allocation-failure error path requiring induced memory pressure and heap grooming; UAF can yield full memory-safety compromise (C/I/A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:24 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 17:19 EUVD

CVE Published

Jul 19, 2026 - 14:55 cve.org

HIGH 7.8

CVE Published

Jul 19, 2026 - 14:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

iio: buffer: hw-consumer: fix use-after-free in error path

In the err_put_buffers cleanup path of iio_hw_consumer_alloc(), the code was using list_for_each_entry() to iterate through buffers while calling iio_buffer_put() which can free the current buffer if refcount drops to 0. The list_for_each_entry() loop macro then evaluates buf->head.next to continue iteration, accessing the freed buffer.

Fix this by using list_for_each_entry_safe().

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel's Industrial I/O (IIO) buffer hardware-consumer subsystem stems from a use-after-free in the error-handling path of iio_hw_consumer_alloc(). When buffer allocation fails, the cleanup routine iterated the buffer list with the unsafe list_for_each_entry() macro while iio_buffer_put() could free the current buffer, causing the loop to dereference freed memory. CVSS is 7.8 (High) with local vector and low privileges; EPSS is low at 0.21% (11th percentile), and there is no public exploit identified at time of analysis, consistent with this being a defect reachable only in a rare allocation-failure path.

Technical ContextAI

The affected code is the kernel's IIO (Industrial I/O) framework, specifically the hardware-consumer helper in drivers/iio/buffer/industrialio-hw-consumer.c, which lets in-kernel consumers attach to IIO device buffers (common for ADCs, sensors, and data-acquisition hardware). The root cause is CWE-416 (Use-After-Free): the err_put_buffers cleanup loop used list_for_each_entry(), which reads buf->head.next to advance after the loop body has already called iio_buffer_put(); when that put drops the last reference, the buffer is freed and the subsequent list traversal reads freed memory. The fix substitutes list_for_each_entry_safe(), which caches the next pointer before the body runs, making destructive iteration safe. CPE data identifies the affected product only generically as cpe:2.3:a:linux:linux, i.e. the mainline/stable Linux kernel rather than a specific distribution.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, or mainline 7.1 - whichever matches your maintenance branch, or apply your distribution's backport once available. The upstream fix is a one-line change from list_for_each_entry() to list_for_each_entry_safe() in the err_put_buffers path of iio_hw_consumer_alloc(); the corresponding stable commits are linked from git.kernel.org (e.g., https://git.kernel.org/stable/c/d2759d49860b9a39b5cde2fb88e4b822ddf5f58f). If immediate patching is not possible, the practical compensating control is to unload or disable the industrialio-hw-consumer / IIO driver stack on systems that do not use industrial-sensor or ADC hardware (CONFIG_IIO_HW_CONSUMER), which removes the vulnerable code path at the cost of losing in-kernel IIO consumer functionality for any hardware that relies on it; because the bug only triggers on allocation failure, ensuring adequate memory headroom also reduces the already-low likelihood of reaching the error path.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

EUVD-2026-45703 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-45703

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code