What is the CVSS score of EUVD-2026-45847?

EUVD-2026-45847 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by EUVD-2026-45847?

CVE-2026-64162 is a spinlock initialization defect in Intel's idpf network driver that, despite a CRITICAL CVSS rating of 9.8, poses minimal organizational risk due to extremely low EPSS score…. A patch is available.

How to fix or mitigate EUVD-2026-45847?

Within 24 hours, identify systems in your environment running Intel idpf drivers with PTP enabled to determine exposure scope. Within 7 days, obtain and stage the Linux kernel patch for affected systems. Complete patching of all identified systems within 30 days during standard maintenance windows.

Linux Kernel EUVD-2026-45847

| CVE-2026-64162 CRITICAL

2026-07-19 Linux

GHSA-7wrv-94gw-59pj

Information Disclosure Linux

Critical

Disputed · 9.8 Vendor: Linux

Severity by source

Sources disagree (Low–Critical)

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

1.9 LOW

Local init-time race requiring privileged driver load/reset (AV:L, PR:H) and precise timing (AC:H); no confidentiality or integrity impact, at most a transient availability/robustness issue (A:L).

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SUSE

5.5 CRITICAL

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:47 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

9.8 (CRITICAL)

Patch available

Jul 19, 2026 - 17:03 EUVD

CVE Published

Jul 19, 2026 - 15:40 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 19, 2026 - 15:40 cve.org

CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()

In idpf_ptp_init(), read_dev_clk_lock is initialized after ptp_schedule_worker() had already been called (and after idpf_ptp_settime64() could reach the lock). The PTP aux worker fires immediately upon scheduling and can call into idpf_ptp_read_src_clk_reg_direct(), which takes spin_lock(&ptp->read_dev_clk_lock) on an uninitialized lock, triggering the lockdep "non-static key" warning:

[12973.796587] idpf 0000:83:00.0: Device HW Reset initiated [12974.094507] INFO: trying to register non-static key. ... [12974.097208] Call Trace: [12974.097213] <TASK> [12974.097218] dump_stack_lvl+0x93/0xe0 [12974.097234] register_lock_class+0x4c4/0x4e0 [12974.097249] ? __lock_acquire+0x427/0x2290 [12974.097259] __lock_acquire+0x98/0x2290 [12974.097272] lock_acquire+0xc6/0x310 [12974.097281] ? idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf] [12974.097311] ? lockdep_hardirqs_on_prepare+0xde/0x190 [12974.097318] ? finish_task_switch.isra.0+0xd2/0x350 [12974.097330] ? __pfx_ptp_aux_kworker+0x10/0x10 [ptp] [12974.097343] _raw_spin_lock+0x30/0x40 [12974.097353] ? idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf] [12974.097373] idpf_ptp_read_src_clk_reg+0xb7/0x150 [idpf] [12974.097391] ? kthread_worker_fn+0x88/0x3d0 [12974.097404] ? kthread_worker_fn+0x4e/0x3d0 [12974.097411] idpf_ptp_update_cached_phctime+0x26/0x120 [idpf] [12974.097428] ? _raw_spin_unlock_irq+0x28/0x50 [12974.097436] idpf_ptp_do_aux_work+0x15/0x20 [idpf] [12974.097454] ptp_aux_kworker+0x20/0x40 [ptp] [12974.097464] kthread_worker_fn+0xd5/0x3d0 [12974.097474] ? __pfx_kthread_worker_fn+0x10/0x10 [12974.097482] kthread+0xf4/0x130 [12974.097489] ? __pfx_kthread+0x10/0x10 [12974.097498] ret_from_fork+0x32c/0x410 [12974.097512] ? __pfx_kthread+0x10/0x10 [12974.097519] ret_from_fork_asm+0x1a/0x30 [12974.097540] </TASK>

Move the call to spin_lock_init() up a bit to make sure read_dev_clk_lock is not touched before it's been initialized.

AnalysisAI

Incorrect spinlock initialization ordering in the Linux kernel's idpf network driver (Intel Infrastructure Data Path Function) causes the PTP auxiliary worker to acquire the read_dev_clk_lock before spin_lock_init() has run, producing a lockdep 'non-static key' warning and a race on an uninitialized lock during device init/reset. This is a local kernel-driver initialization bug affecting systems using the idpf driver with PTP enabled, not a remotely reachable code-execution flaw; no public exploit identified at time of analysis and the EPSS score is negligible (0.15%). Despite an automated CVSS of 9.8, the real-world security impact is minimal and confined to hosts running specific Intel networking hardware.

Technical ContextAI

The affected component is the idpf (Infrastructure Data Path Function) driver in the Linux kernel, which supports Intel's foundational NIC/IPU devices and includes PTP (Precision Time Protocol) hardware clock support. In idpf_ptp_init(), ptp_schedule_worker() is invoked before spin_lock_init(&ptp->read_dev_clk_lock). The PTP auxiliary kworker fires immediately upon scheduling and calls idpf_ptp_do_aux_work → idpf_ptp_update_cached_phctime → idpf_ptp_read_src_clk_reg_direct, which takes spin_lock(&ptp->read_dev_clk_lock) on a lock whose key has not yet been registered. The same window is reachable via idpf_ptp_settime64(). This is an initialization-order defect (a use-before-initialization of a synchronization primitive, akin to CWE-665 Improper Initialization); the input lists CWE as N/A. The fix simply hoists spin_lock_init() above the worker scheduling call so the lock is valid before any consumer can reach it.

RemediationAI

Vendor-released patch: update to a fixed Linux kernel build - 6.18.34, 7.0.11, or 7.1, or apply one of the stable fix commits (git.kernel.org/stable/c/eb5991d4c8ba2e8153dfcda3e66a9608377b7dce, /3122d70b7c0101d897fb795658a7b93f854935f2, /da4f76b6a84ede14a71282ef841768299ead0221), which move spin_lock_init() ahead of ptp_schedule_worker(). Because this is a one-line ordering fix with no attacker-facing surface, patching via your distribution's normal kernel-update channel is the appropriate and only real remediation. If patching must be deferred, the only meaningful compensating control is to avoid loading the idpf driver on affected hosts (for example, blacklist the idpf module where the affected Intel hardware is not required) or disable PTP usage on those interfaces - the trade-off is loss of hardware timestamping/PTP time synchronization and, if blacklisted, loss of connectivity on idpf-backed NICs, so this is only viable on systems that do not depend on that hardware.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

EUVD-2026-45847 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-45847

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code