What is the CVSS score of EUVD-2026-48970?

EUVD-2026-48970 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-48970?

Yes, a patch is available for EUVD-2026-48970. Update the affected software to the latest version immediately.

Linux Kernel EUVD-2026-48970

| CVE-2026-64258 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-07-25 Linux

GHSA-942f-2j62-7hwj

Null Pointer Dereference Denial Of Service Linux

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local low-privilege access required; race condition crashes kernel with no confidentiality or integrity impact, only availability loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

4.7 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 16:19 vuln.today

CVSS changed

Aug 12, 2026 - 16:07 NVD

5.5 (MEDIUM)

Patch available

Jul 25, 2026 - 11:18 EUVD

CVE Published

Jul 25, 2026 - 08:49 nvd

MEDIUM 5.5

CVE Published

Jul 25, 2026 - 08:49 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref

If a copy into the userspace ring buffer fails, a request will be terminated and fuse_uring_req_end() will set ent->fuse_req to NULL but it will leave the entry on ent_w_req_queue in FRRS_FUSE_REQ state. This can lead to a NULL deref if the request expiration logic scans ent_w_req_queue in the window before the entry is moved off it.

Fix this by taking the entry off ent_w_req_queue and changing its state from FRRS_FUSE_REQ to FRRS_INVALID before terminating the request.

AnalysisAI

NULL pointer dereference in the Linux kernel's fuse-uring subsystem enables a local low-privilege attacker to crash the kernel, causing a denial of service. The flaw arises from a state management race in the fuse-uring request lifecycle: when a copy into a userspace io_uring ring buffer fails, the entry's request pointer is nullified but the entry remains on the active queue, allowing the expiration scanner to dereference the NULL pointer in a narrow race window. No public exploit has been identified and EPSS stands at 0.21% (11th percentile), indicating low likelihood of opportunistic exploitation.

Technical ContextAI

The fuse-uring subsystem implements io_uring-based FUSE (Filesystem in Userspace) request dispatch in the Linux kernel, introduced to improve performance of userspace filesystem operations. The vulnerability resides in the ring entry lifecycle management: specifically in how fuse_uring_req_end() handles copy failures. CWE-476 (NULL Pointer Dereference) captures the root cause - a state inconsistency where ent->fuse_req is set to NULL after a failed userspace copy, but the entry's position on ent_w_req_queue and its state flag (FRRS_FUSE_REQ) are not updated atomically. This creates a TOCTOU-style race window in which the request expiration scanner can iterate ent_w_req_queue, encounter the stale entry, and dereference the now-NULL pointer. The fix transitions the entry state from FRRS_FUSE_REQ to FRRS_INVALID and removes it from the queue before terminating the request. Affected product is identified by CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, covering kernel versions from the introducing commit 4fea593e625cd50d4d11be227007849b12f17bfb through the fix commits.

RemediationAI

Upgrade to Linux kernel 7.1.4, 6.18.39, or later, or apply the fix available in the 7.2-rc1 mainline. The relevant upstream fix commits are published at https://git.kernel.org/stable/c/0b466cf1b96e191b06b496c4de79da15315c3a9a, https://git.kernel.org/stable/c/0a7f33010c0e4cd92937e088a54350381fd0fbf2, and https://git.kernel.org/stable/c/1c57a69be962d459c5e705f5cb4355b841b3461c. Distribution maintainers (RHEL, Debian, Ubuntu, SUSE, etc.) should be consulted for backported packages. As a compensating control on systems that cannot be patched immediately, disabling or restricting use of the fuse-uring interface - for example by preventing unprivileged users from mounting FUSE filesystems via io_uring - eliminates the vulnerable code path, though this may disrupt applications that rely on io_uring-based FUSE operations. NVD entry is available at https://nvd.nist.gov/vuln/detail/CVE-2026-64258 for tracking.

Same weakness CWE-476 – NULL Pointer Dereference

View all

CVE-2016-0742 HIGH

7.5

CVE-2014-3470 MEDIUM

4.3

CVE-2017-3730 HIGH POC

7.5

CVE-2017-3169 CRITICAL POC

9.8

CVE-2016-4957 HIGH

7.5

CVE-2015-3194 HIGH

7.5

CVE-2026-21525 MEDIUM

6.2

CVE-2017-0016 MEDIUM

5.9

Same technique Null Pointer Dereference

View all

CVE-2016-0742 HIGH

7.5

CVE-2014-3470 MEDIUM

4.3

CVE-2017-3730 HIGH POC

7.5

CVE-2017-3169 CRITICAL POC

9.8

CVE-2016-4957 HIGH

7.5

CVE-2015-3194 HIGH

7.5

CVE-2026-21525 MEDIUM

6.2

CVE-2017-0016 MEDIUM

5.9

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected

EUVD-2026-48970 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-48970

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-476 – NULL Pointer Dereference

Same technique Null Pointer Dereference

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code