What is the CVSS score of EUVD-2026-55527?

EUVD-2026-55527 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-55527?

A critical use-after-free vulnerability in Linux kernel's Phonet networking subsystem (CVE-2026-68144, CVSS 9.8) enables memory corruption and information disclosure when processing crafted Phonet…. A patch is available.

How to fix or mitigate EUVD-2026-55527?

Within 24 hours, inventory all systems running Linux kernel versions 2.6.28 through the affected range and determine exposure to Phonet traffic. Within 7 days, contact your Linux distribution provider (Red Hat, Ubuntu, Debian, SUSE, etc.) to obtain and deploy the patched kernel version specific to your environment; test in non-production systems first. Within 30 days, complete kernel patch deployment across all affected infrastructure, verify through automated kernel version auditing, and establish alerts for supplementary Phonet subsystem advisories.

Linux Kernel EUVD-2026-55527

| CVE-2026-68144 CRITICAL

2026-08-10 Linux

GHSA-362p-g3rp-mxch

Information Disclosure Linux Suse

9.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.9 MEDIUM

Phonet is link-layer so AV:A not AV:N; winning the skb-realloc race gives AC:H; unauthenticated receive path PR:N; a 1-byte UAF read yields limited disclosure (C:L) and likely kernel crash (A:H).

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

7.0 HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 01:47 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

9.8 (CRITICAL)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 11:59 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 10, 2026 - 11:59 cve.org

CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

phonet: pep: fix use-after-free in pep_get_sb()

pep_get_sb() doesn't consider that pskb_may_pull() might have relocated the skb data, and continue to access the older pointer, causing UAF.

Reproduced under KASAN:

BUG: KASAN: slab-use-after-free in pep_get_sb+0x234/0x3b0 Read of size 1 at addr ff11000105510f50 by task repro/157 pep_get_sb+0x234/0x3b0 pipe_handler_do_rcv+0x5f7/0xa10 pep_do_rcv+0x203/0x410 __sk_receive_skb+0x471/0x4a0 phonet_rcv+0x5b3/0x6c0 __netif_receive_skb+0xcc/0x1d0

Refetch the header with skb_header_pointer() after pskb_may_pull(), so the possibly stale pointer is no longer dereferenced. There are better ways to solve this, but, this is the less instrusive one.

AnalysisAI

Use-after-free in the Linux kernel's Phonet PEP (Pipe End Point) receive path lets an attacker trigger memory corruption via crafted Phonet packets. In pep_get_sb(), a call to pskb_may_pull() can reallocate the skb data buffer, but the code keeps dereferencing the now-stale header pointer, producing a slab use-after-free read confirmed under KASAN. The flaw affects kernels from 2.6.28 through the fixed stable releases and is tagged as an information-disclosure issue; no public exploit identified at time of analysis and it is not listed in CISA KEV, with a low EPSS score (0.18%).

Technical ContextAI

Phonet is a legacy packet protocol originally used to talk to Nokia cellular modems, implemented in the Linux kernel's net/phonet subsystem. The PEP (Pipe End Point) module handles pipe control messages; pep_get_sb() parses a sub-block header from an incoming socket buffer (skb). The root cause is a classic use-after-free (CWE-416, though CWE is reported N/A in the feed): pskb_may_pull() may linearize and reallocate the skb's data region, invalidating any previously cached pointer into skb->data. The code retained and dereferenced that stale pointer instead of refetching. The upstream fix refetches the header via skb_header_pointer() after pskb_may_pull(), so the relocated buffer is read safely.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5 (or later in each series) - via your distribution's kernel updates, which incorporate the git.kernel.org stable commits listed in the references. If you cannot patch immediately, the highest-leverage compensating control is to disable Phonet entirely: unload/blacklist the module (blacklist phonet in modprobe.d) or run a kernel built without CONFIG_PHONET, since the subsystem is legacy and unused on virtually all modern systems - the only trade-off is loss of cellular-modem Phonet connectivity, which almost no production host needs. Where the module cannot be removed, restrict which processes can create AF_PHONET sockets and limit adjacent network access to the interface carrying Phonet traffic. Advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-68144.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

EUVD-2026-55527 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-55527

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code