What is the CVSS score of EUVD-2026-59095?

EUVD-2026-59095 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by EUVD-2026-59095?

PowerPC E500 Linux systems with kernel versions 7.0 through 7.2-rc4 lack critical address masking protections due to a compile-time configuration typo, exposing deployed instances to potential kernel…

How to fix or mitigate EUVD-2026-59095?

Within 24 hours, identify and inventory all PowerPC E500 systems running Linux kernel versions 7.0 through 7.1.4 or 7.2-rc4, and document their current access controls and deployment context. Within 7 days, implement principle-of-least-privilege restrictions on local user accounts for affected systems, enable comprehensive kernel audit logging, and establish network segmentation to contain potential compromise of local accounts. Within 30 days, establish contact with kernel maintainers for patch availability timelines, evaluate migration feasibility to unaffected kernel versions, and document all interim mitigations with assigned ownership and quarterly review dates.

Linux Kernel EUVD-2026-59095

| CVE-2026-68473 HIGH

2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-h544-cjrp-f5fc

Information Disclosure Linux Red Hat Suse

High

Disputed · 7.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Sources disagree (Low–High)

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

AC:H reflects that turning absent address masking into controlled kernel memory access requires non-trivial, hardware-specific exploit development with no available public technique.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

2.5 LOW

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 12:53 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

CVE Published

Aug 15, 2026 - 06:20 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 06:20 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

powerpc/uaccess: correct check for CONFIG_PPC_E500 in mask_user_address()

mask_user_address() incorrectly checks for CONFIG_E500 instead of CONFIG_PPC_E500, causing mask_user_address_isel() to not be used on E500 hardware. Fix the check to use the correct name.

AnalysisAI

PowerPC E500 systems running Linux kernel 7.0 through 7.1.4 and 7.2-rc4 silently lose kernel address-masking protection due to a compile-time preprocessor symbol typo - CONFIG_E500 instead of CONFIG_PPC_E500 - causing mask_user_address_isel() to be omitted from E500 builds entirely. A local low-privileged user on affected E500 hardware can exploit the absent address-masking primitive to achieve high-impact memory disclosure, integrity corruption, or denial of service against the kernel. No public exploit exists, EPSS is 0.19% (9th percentile), and this vulnerability is not in CISA KEV, indicating very limited current exploitation activity despite a CVSS score of 7.8.

Technical ContextAI

The flaw resides in the PowerPC architecture-specific uaccess layer of the Linux kernel, in the mask_user_address() function. On Freescale/NXP PowerPC E500 cores, the kernel is supposed to invoke mask_user_address_isel(), which uses the E500's ISEL instruction to mask user-space addresses before kernel access - a hardware-enforced primitive analogous to SMAP mitigations on x86. The compile-time guard for this code path checks #ifdef CONFIG_E500 when it should check #ifdef CONFIG_PPC_E500. Since CONFIG_E500 is not defined in E500 kernel builds (the correct symbol is CONFIG_PPC_E500), the ISEL-based masking path is never compiled in, leaving address masking broken at runtime on all affected E500 systems. No CWE was formally assigned, but the root cause class maps to CWE-670 (Always-Incorrect Control Flow Implementation) - a logic path that is intended to execute but never does due to a wrong conditional symbol. Affected commit range confirmed by ENISA EUVD-2026-59095 as 861574d51bbd through exclusive commits d610d3ab18197 and d5c234774a82f.

RemediationAI

The primary fix is upgrading to Linux kernel 7.1.5 or applying the stable patch commits directly: https://git.kernel.org/stable/c/d610d3ab18197d87618da11ec5fe8b3cebf32208 for the 7.1.x branch and https://git.kernel.org/stable/c/d5c234774a82f27b594f70c15fc45ce3648e4295 for the 7.2 branch. Both commits correct the single-symbol error from CONFIG_E500 to CONFIG_PPC_E500 in mask_user_address(), restoring the ISEL-based address masking. No runtime workaround exists - the broken code path is a compile-time omission that cannot be patched without rebuilding the kernel. As a compensating control for E500 systems that cannot be immediately patched, administrators should restrict local shell and code execution access to fully trusted accounts only, since PR:L (local low-privilege) is the required attack precondition. Note that tightening local access removes the exploitation prerequisite entirely but may affect legitimate multi-user workflows. Upstream fix availability is confirmed via git.kernel.org stable commits; a released patched version (7.1.5) is listed in EUVD data but should be independently verified against the distribution's release notes before deployment.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Low

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

EUVD-2026-59095 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-59095

Severity by source

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code