What is the CVSS score of EUVD-2026-59334?

EUVD-2026-59334 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-59334?

A privilege escalation vulnerability in the Linux kernel's netfilter ipset subsystem (CVE-2026-72435) allows local attackers with low privileges to escalate system access through an improper RCU…. A patch is available.

How to fix or mitigate EUVD-2026-59334?

Within 24 hours, audit infrastructure to identify all systems running the Linux kernel with netfilter ipset enabled and document their current kernel versions. Within 7 days, obtain the patched kernel from your Linux distribution vendor and validate it in non-production environments to confirm compatibility with deployed applications and security tools. Within 30 days, deploy the patched kernel across production systems in phases, starting with non-critical infrastructure and proceeding through staging to production, monitoring system stability and kernel logs throughout the rollout.

Linux Kernel EUVD-2026-59334

| CVE-2026-72435 HIGH

2026-08-15 Linux

GHSA-g5m8-p567-grv6

Information Disclosure Linux Red Hat Suse

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Race condition requires timing to win; AC:H reflects this, while PR:L reflects CAP_NET_ADMIN via user namespaces on common configurations.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

4.5 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 09:24 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:56 cve.org

HIGH 7.8

CVE Published

Aug 15, 2026 - 05:56 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()

Sashiko pointed out that kfree_rcu() was called before rcu_assign_pointer() in handling the comment extension. Fix the order so that rcu_assign_pointer() called first.

AnalysisAI

Incorrect RCU (Read-Copy-Update) operation ordering in the Linux kernel's netfilter ipset subsystem allows a local attacker with low privileges to trigger a use-after-free condition in kernel memory, potentially leading to privilege escalation or system crash. The flaw exists because kfree_rcu() was called before rcu_assign_pointer() in the comment extension handling path - scheduling memory for freeing before the pointer update is visible to all CPUs, creating a race window. With a CVSS score of 7.8 and an EPSS of 0.22% (13th percentile), this is assessed as a serious local privilege escalation with low likelihood of opportunistic exploitation. No public exploit has been identified and CISA KEV status is not confirmed.

Technical ContextAI

The vulnerability resides in the Linux kernel's netfilter ipset subsystem (net/netfilter/ipset/), specifically in the comment extension handling code. RCU (Read-Copy-Update) is a synchronization mechanism used extensively in the Linux kernel for concurrent read-heavy workloads; correct usage mandates that rcu_assign_pointer() - which publishes the new pointer value with a memory barrier - must be called before kfree_rcu(), which defers freeing the old object until after all RCU read-side critical sections have completed. By inverting this order, the old object could be freed while readers still hold a reference, constituting a use-after-free. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* starting from commit b57b2d1fa53fe8563bdfc66a33b844463b9af285. No formal CWE is assigned, but the root cause maps to CWE-416 (Use After Free) or CWE-362 (Race Condition), stemming from incorrect synchronization primitive ordering.

RemediationAI

The primary fix is to upgrade the Linux kernel to a patched stable release: 5.10.261 or later for the 5.10.x LTS branch, 5.15.212 or later for 5.15.x LTS, 6.1.178 or later for 6.1.x LTS, 6.6.145 or later for 6.6.x LTS, 6.12.97 or later for 6.12.x LTS, 6.18.40 or later for 6.18.x, 7.1.5 or later for the 7.1.x branch, or 7.2-rc1 for the mainline development branch. The authoritative upstream patches are indexed at the kernel stable git references provided (e.g., https://git.kernel.org/stable/c/c9787d7c24ffd83019f379455e1b97fb4f0f75eb). As a compensating control on environments where an immediate kernel update is not feasible, disabling unprivileged user namespaces (sysctl kernel.unprivileged_userns_clone=0 on Debian/Ubuntu; setting user.max_user_namespaces=0 on RHEL-family systems) reduces the practical attack surface by requiring CAP_NET_ADMIN from a fully privileged context - though this may break container workloads and Flatpak/Snap applications that depend on user namespaces. Alternatively, restricting the ipset kernel module from loading (modprobe.d blacklist ip_set) eliminates the vulnerable code path entirely, but disables all ipset-based firewall rules.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

EUVD-2026-59334 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-59334

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code