What is the CVSS score of EUVD-2026-45786?

EUVD-2026-45786 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-45786?

Yes, a patch is available for EUVD-2026-45786. Update the affected software to the latest version immediately.

Linux Kernel EUVD-2026-45786

| CVE-2026-64101 MEDIUM

2026-07-19 Linux

GHSA-954m-592c-4vpc

Information Disclosure Linux Red Hat Suse

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local low-privilege attacker required; no confidentiality or integrity impact; kernel crash is the sole outcome.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

4.4 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 16:19 vuln.today

CVSS changed

Aug 11, 2026 - 16:07 NVD

5.5 (MEDIUM)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:40 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:40 nvd

MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

fwctl: pds: Validate RPC input size before parsing

The fwctl core allocates the device-specific RPC input buffer with fwctl_rpc.in_len and passes that buffer to the driver callback.

pdsfc_fw_rpc() casts the buffer to struct fwctl_rpc_pds and then calls pdsfc_validate_rpc(), which reads fields from that structure before checking that the input buffer is large enough to contain it. A short in_len can make pds_fwctl read beyond the allocation.

Reject pds RPC buffers that are smaller than struct fwctl_rpc_pds before parsing any pds-specific fields.

AnalysisAI

Out-of-bounds heap read in the Linux kernel's fwctl pds driver allows a local low-privileged user to crash the kernel by submitting an undersized RPC buffer, resulting in a denial of service. Affected kernel versions include Linux 6.15 and all stable trees prior to 6.18.34, 7.0.11, and 7.1, with exploitation requiring the pds_fwctl module loaded and a compatible PDS network adapter present. No public exploit exists and EPSS is 0.17% (7th percentile), placing this as a low-priority stability fix unless deployments expose the fwctl device node to untrusted local users.

Technical ContextAI

The fwctl subsystem provides a firmware control interface between userspace and kernel drivers. In the pds (Pensando/AMD Platform Device Subsystem) fwctl driver, the function pdsfc_fw_rpc() receives a raw buffer allocated by the fwctl core based on the caller-supplied fwctl_rpc.in_len value. The function casts this buffer directly to struct fwctl_rpc_pds and immediately passes it to pdsfc_validate_rpc(), which dereferences fields within the structure before any size check occurs. A caller supplying an in_len smaller than sizeof(struct fwctl_rpc_pds) causes the kernel to read beyond the end of the heap allocation - a classic time-of-check/time-of-use ordering flaw akin to CWE-125 (Out-of-bounds Read), though CWE is listed as N/A in this advisory. The CPE cpe:2.3:a:linux:linux identifies the upstream Linux kernel as the affected component. The fix, confirmed by three stable-tree commits on kernel.org, adds an explicit size check before any field access.

RemediationAI

Apply the vendor-released patches by upgrading to Linux 6.18.34, 7.0.11, or 7.1, which contain the fix via stable commits available at https://git.kernel.org/stable/c/0d470d36551058e3f728574308b815a80bca710f, https://git.kernel.org/stable/c/e7537735028c3ad4b0bfc02ff8fa2a1a28aa04fe, and https://git.kernel.org/stable/c/9e3f18883a98420a3b8873c6f894bc57e9b98e41. Ubuntu users should apply the update referenced in USN-8593-1 at https://ubuntu.com/security/notices/USN-8593-1. Where immediate patching is not feasible, restrict access permissions on the fwctl device node (typically /dev/fwctl/*) to root or a trusted administrative group only, preventing unprivileged users from submitting crafted RPC buffers - this eliminates the attack surface at the cost of restricting fwctl tooling to privileged users. On systems that do not use Pensando/AMD PDS network adapters, unloading or blacklisting the pds_fwctl kernel module (modprobe -r pds_fwctl or adding it to /etc/modprobe.d/blacklist.conf) entirely removes the vulnerable code path with no functional impact.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

EUVD-2026-45786 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-45786

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code