Skip to main content

Linux Kernel EUVDEUVD-2026-48643

| CVE-2026-64234 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-07-24 Linux GHSA-hhmc-qrcv-x7hv
Denial Of Service Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local low-privilege access
  2. Delivery
    Verify pch_uart DMA path is active
  3. Exploit
    Induce DMA memory pressure or exhaustion
  4. Execution
    Trigger dma_alloc_coherent() to return NULL
  5. Persist
    Dereference NULL pointer in dma_handle_rx()
  6. Impact
    Kernel panic crashes system

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires local system access with at least low-level privileges (CVSS PR:L). The target system must be equipped with Intel PCH (Platform Controller Hub) UART hardware, have the pch_uart kernel module loaded, and be operating in DMA mode for serial receive - this is a non-default configuration in most general-purpose Linux deployments, which do not include PCH UART hardware. A DMA memory allocation failure must occur, either naturally under extreme memory pressure or induced deliberately by the attacker through memory exhaustion. Systems not using Intel PCH serial hardware, or where the pch_uart module is not loaded, are entirely unaffected. No network exposure is required, and there is no remote attack vector.
Impact

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H scores this at 5.5 (medium), capturing a local, low-privilege denial-of-service with no confidentiality or integrity impact. The AC:L rating reflects that a local attacker can deliberately induce memory pressure to trigger the allocation failure - however, the hardware prerequisite (Intel PCH UART with DMA active) is a real-world narrowing factor not captured in the CVSS score. Even a mid-sized municipal IT team in tczew running general-purpose Linux infrastructure on modern hardware is unlikely to have the pch_uart driver loaded, making this a routine patch priority rather than an emergency response item. EPSS of 0.17% (6th percentile) confirms negligible probability of exploitation in the wild, there is no CISA KEV listing, and no public proof-of-concept is known at time of analysis. The combination of hardware dependency, local-only access, and low EPSS strongly favors treating this as a standard kernel maintenance patch rather than an elevated-priority incident.
Exploit ScenarioDerived

A local user with standard low-level system privileges on an Intel PCH-equipped machine allocates large amounts of memory or otherwise exhausts DMA-coherent memory, causing a subsequent dma_alloc_coherent() call within the pch_uart driver's DMA initialization path to return NULL. When dma_handle_rx() subsequently dereferences the unchecked NULL pointer during a serial receive operation, a kernel NULL pointer dereference oops is triggered, crashing or destabilizing the system. No public proof-of-concept exploit is known at time of analysis.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 12, 2026

NULL pointer dereference in the Linux kernel's pch_uart serial driver allows a local low-privileged user to crash the kernel by triggering a failed DMA memory allocation in dma_handle_rx(). Systems running Intel PCH (Platform Controller Hub) hardware with the pch_uart driver active and DMA enabled are vulnerable to denial of service via kernel panic. No public exploit or CISA KEV listing exists; with an EPSS of 0.17% (6th percentile), real-world exploitation risk is low, but patches are confirmed across multiple stable kernel branches.

RemediationAI

The primary fix is upgrading to a patched Linux kernel: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, or 7.1, sourced from upstream commits at https://git.kernel.org/stable/c/760df81763b391bb5f0dcb0b7597b736da753ae4 and sibling stable branch commits. Ubuntu users should apply USN-8618-1 via standard package management. If immediate kernel upgrade is not feasible, a targeted compensating control is to unload and blacklist the pch_uart module ('modprobe -r pch_uart' and adding 'blacklist pch_uart' to /etc/modprobe.d/) on any system that does not require Intel PCH serial port functionality; this fully eliminates the vulnerable code path, with the trade-off of losing PCH serial port support. Restricting local user privilege escalation paths as a defense-in-depth measure reduces but does not eliminate exploitation opportunity.

Affected VersionsENISA

Linux patch: 7.0.12
Linux patch: 5.10.259
Linux 3c6a483275f47a2ef7119309ad3d791c10cf30da <daea997bb244aeb50cbb2e5e075fb446a6cf068f
Linux patch: 0
Linux patch: 5.15.210
Linux 3c6a483275f47a2ef7119309ad3d791c10cf30da <d8d53a343ebe74274ca17b1e1993042e99f8c863
Linux 3c6a483275f47a2ef7119309ad3d791c10cf30da <6fe472c1bbbe238e91141f7cabc1226e96a60d43
Linux 3c6a483275f47a2ef7119309ad3d791c10cf30da <5f2e2a240dc1846e049bc67e9c3cdf5b031d08bf
Linux patch: 6.1.176
Linux patch: 7.1
Linux 2.6.38
Linux patch: 6.18.35
Linux 3c6a483275f47a2ef7119309ad3d791c10cf30da <760df81763b391bb5f0dcb0b7597b736da753ae4
Linux 3c6a483275f47a2ef7119309ad3d791c10cf30da <6dd5c0ea139b586ad5a091677056dafd405cfe82
Linux 3c6a483275f47a2ef7119309ad3d791c10cf30da <66f8bfea055b23719b4fd6ce207c44de37d82a59
Linux 3c6a483275f47a2ef7119309ad3d791c10cf30da <d846df2dfbc2469a688833b4cc4f8aa80672bde8
Linux patch: 6.6.143
Linux patch: 6.12.93

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The pch_uart driver (drivers/tty/serial/pch_uart.c) handles serial communication for Intel Platform Controller Hub chipsets, found in certain embedded, industrial, and server-class systems. It uses Linux's DMA API to manage receive operations via dma_handle_rx(). The root cause is CWE-476 (NULL Pointer Dereference): dma_alloc_coherent(), which allocates coherent DMA memory, can return NULL on failure (e.g., under memory pressure or DMA zone exhaustion), and the driver did not check this return value before using the pointer in dma_handle_rx(). The fix introduces an allocation failure check and a goto-based cleanup ladder to release DMA channels and the PCI device reference properly. Affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, with the introduced-in version traced to Linux 2.6.38 per EUVD data.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.5 MEDIUM

Local low-privilege attacker can deliberately induce memory pressure to trigger the NULL return; availability is the sole impact; hardware dependency narrows real-world scope but does not change base metrics.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Aug 12, 2026 - 19:22 NVD
5.5 (MEDIUM)
Patch available
Jul 24, 2026 - 17:48 EUVD
CVE Published
Jul 24, 2026 - 15:27 nvd
MEDIUM 5.5
CVE Published
Jul 24, 2026 - 15:27 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

tty: serial: pch_uart: add check for dma_alloc_coherent()

Add a check for dma_alloc_coherent() failure to prevent a potential NULL pointer dereference in dma_handle_rx(). Properly release DMA channels and the PCI device reference using a goto ladder if the allocation fails.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Low
niche Intel PCH serial driver, not present on typical Linux deployments
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Micro 6.2 Fixed
openSUSE Leap 16.0 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-64234 ADVISORY https://ubuntu.com/security/notices/USN-8618-1 ADVISORY https://vuldb.com/vuln/382970 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23066/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23068/ REF https://git.kernel.org/stable/c/5f2e2a240dc1846e049bc67e9c3cdf5b031d08bf REF https://git.kernel.org/stable/c/66f8bfea055b23719b4fd6ce207c44de37d82a59 REF https://git.kernel.org/stable/c/6dd5c0ea139b586ad5a091677056dafd405cfe82 REF https://git.kernel.org/stable/c/6fe472c1bbbe238e91141f7cabc1226e96a60d43 REF https://git.kernel.org/stable/c/760df81763b391bb5f0dcb0b7597b736da753ae4 REF https://git.kernel.org/stable/c/d846df2dfbc2469a688833b4cc4f8aa80672bde8 REF https://git.kernel.org/stable/c/d8d53a343ebe74274ca17b1e1993042e99f8c863 REF https://git.kernel.org/stable/c/daea997bb244aeb50cbb2e5e075fb446a6cf068f

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy