What is the CVSS score of EUVD-2026-49026?

EUVD-2026-49026 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-49026?

Yes, a patch is available for EUVD-2026-49026. Update the affected software to the latest version immediately.

Linux Kernel EUVD-2026-49026

| CVE-2026-64314 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-07-25 Linux

GHSA-8q9p-r3g4-95mr

Denial Of Service Linux Null Pointer Dereference Red Hat Suse

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local low-privilege access needed to invoke crypto template API; impact is availability-only via kernel crash, no C or I.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 03, 2026 - 16:02 vuln.today

CVSS changed

Sep 03, 2026 - 15:52 NVD

5.5 (MEDIUM)

Patch available

Jul 25, 2026 - 11:18 EUVD

CVE Published

Jul 25, 2026 - 08:49 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 25, 2026 - 08:49 nvd

MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

crypto: chacha20poly1305 - validate poly1305 template argument

chachapoly_create() still accepts the compatibility poly1305 parameter in the template name, but it assumes the second template argument is always present and immediately passes it to strcmp().

When the argument is missing, crypto_attr_alg_name() returns an error pointer. Check for that before comparing the name so malformed template instantiations fail with an error instead of dereferencing the error pointer in strcmp().

This matches the surrounding Crypto API template pattern where crypto_attr_alg_name() results are validated before string-specific use.

AnalysisAI

Null pointer dereference in the Linux kernel's chacha20poly1305 crypto template allows a local unprivileged user to crash the system. The flaw exists in chachapoly_create(), which passes the unvalidated return value of crypto_attr_alg_name() directly to strcmp() when the poly1305 sub-argument is absent in a malformed template string; since that function returns an ERR_PTR on failure, the subsequent strcmp() call dereferences an invalid pointer, triggering a kernel panic. Patches are available across multiple stable branches; no public exploit or active exploitation has been identified at time of analysis.

Technical ContextAI

The Linux kernel Crypto API allows algorithm templates to be composed by naming component algorithms in a structured string (e.g., 'chacha20poly1305(rfc7539,chacha20,poly1305)'). The chachapoly_create() function in crypto/chacha20poly1305.c calls crypto_attr_alg_name() to retrieve the name of the poly1305 sub-algorithm from the template argument list. Per Crypto API convention, crypto_attr_alg_name() returns an ERR_PTR (a non-NULL kernel error-encoded pointer) when the argument is missing or malformed rather than NULL. The vulnerable code skips the IS_ERR() guard and feeds the error pointer directly into strcmp(), which dereferences an invalid address and triggers a NULL/invalid pointer dereference (CWE-476). The fix mirrors the standard Crypto API pattern of validating crypto_attr_alg_name() output with IS_ERR() before any string operation. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to a patched kernel version: Linux 7.1.4, 6.18.39, or 7.2-rc1 as applicable to your stable branch. The upstream fixes are available at https://git.kernel.org/stable/c/265b861bece38318b8e0fc8fac0643d4ef906d31, https://git.kernel.org/stable/c/0016d3c21c6ab60a20be7f565cefb5999f3adeb6, and https://git.kernel.org/stable/c/e74df53b36cdc6b6b9e5488ec883d1d55624737f. Distribution-specific backports (Debian, Ubuntu, RHEL, SUSE) should be applied as they are released through normal update channels. Where immediate kernel patching is not feasible, compensating controls include restricting access to the AF_ALG socket interface via seccomp-bpf profiles or LSM (AppArmor/SELinux) policy to block untrusted processes from invoking the kernel crypto template API; note that this may interfere with legitimate applications relying on the kernel crypto subsystem. Container environments should ensure the crypto namespace is not unnecessarily exposed to unprivileged container users.

Same weakness CWE-476 – NULL Pointer Dereference

View all

CVE-2016-0742 HIGH

7.5

CVE-2014-3470 MEDIUM

4.3

CVE-2017-3730 HIGH POC

7.5

CVE-2017-3169 CRITICAL POC

9.8

CVE-2016-4957 HIGH

7.5

CVE-2015-3194 HIGH

7.5

CVE-2026-21525 MEDIUM

6.2

CVE-2017-0016 MEDIUM

5.9

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected

EUVD-2026-49026 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-49026

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-476 – NULL Pointer Dereference

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code