Is there a patch available for EUVD-2026-64370?

Yes, a patch is available for EUVD-2026-64370. Update the affected software to the latest version immediately.

Linux EUVD-2026-64370

| CVE-2026-74683

2026-08-22 Linux

GHSA-76mx-gxxj-5f36

Buffer Overflow Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Input: evdev - sanitize event type index when fetching event masks

The user-supplied event type index passed to EVIOCGMASK / EVIOCSMASK ioctls is used to index the static counts array in evdev_get_mask_cnt() and client evmasks array in evdev_get_mask().

While the event type is architecturally bounded by EV_CNT, speculative execution may mispredict bounds checks and perform out-of-bounds loads.

Sanitize the event type index in evdev_get_mask_cnt() branchlessly using array_index_mask_nospec(). This clamps the index to 0 for safe array access and forces the returned count to 0 speculatively when the index is out of bounds.

We do not need additional array_index_nospec() calls in evdev_get_mask() because evdev_get_mask_cnt() speculatively forces the count (and resulting xfer_size) to 0 for out-of-bounds types, preventing any speculative memory access to client evmasks array.

Affected VersionsENISA

Linux patch: 6.6.152

Linux 0 <5.10.265

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <433913b4a92214d76e9f0c03ad9128fec943d5f8

Linux 0 <6.6.152

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <5db341189bb7ff041d570dbe36ecca7e32913927

Linux 0 <6.1.183

Linux 0 <6.18.45

Linux patch: 5.10.265

Linux 0 <5.15.216

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <c79b08d8fa230871a3634e34a66e591ac2d084ef

Linux patch: 7.1.9

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <3abd29c61d2ef37c4102cf755b18be53bb9dbea6

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <810e1883d4815f29c30d900ad7333d03cc2515d1

Linux 0 <7.1.9

Linux 0 <6.12.104

Linux patch: 7.2

Linux patch: 5.15.216

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <f27fa9b39f925d26e034a1f382cb45523138f4ae

Linux patch: 6.12.104

Linux patch: 6.18.45

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <4034ef247a9dde3f56660b01f0c3280dac6b1274

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <f3fc329acad9a71b3c077237cbac20670d2358c8

Linux patch: 6.1.183

Affected Packages

euvd linux fix: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Aug 22, 2026 - 16:01 EUVD

CVE Published

Aug 22, 2026 - 15:32 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 85% exploitable

Data Quality

3 sources

Confidence: Low

EUVD

CVE.org

EPSS MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.