Is there a patch available for EUVD-2026-86737?

Yes, a patch is available for EUVD-2026-86737. Update the affected software to the latest version immediately.

Linux EUVD-2026-86737

| CVE-2026-97606

2026-09-25 Linux

GHSA-658w-8mcr-xc7q

View

Awaiting Data No severity or threat signals available yet. Label will update when CVSS score is published or threat intelligence arrives. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fs: autofs: fix memory leak in autofs_fill_super()

In autofs_fill_super(), we create a new inode using autofs_new_ino(), however, if we fail to create root_inode, (that is, root_inode failure path), we return -ENOMEM without freeing the new inode(ino) that we created causing a memory leak. Fix this by adding autofs_free_ino() to free the inode we created in root_inode failure path before returning ENOMEM.

Affected VersionsENISA

Linux patch: 6.18.53

Linux patch: 7.3-rc3

Linux 66917f85db6002ed09cd24186258892fcfca64b6 <9933ad1c4ff67680cd59c47f6d2e81b533bcd467

Linux 66917f85db6002ed09cd24186258892fcfca64b6 <5ab54837fce04a1c9923d0bfd3d5de51fdc768b3

Linux 66917f85db6002ed09cd24186258892fcfca64b6 <6259b5d9bdc45fdb3158406b28c27fa074823159

Linux patch: 7.2.7

Linux 66917f85db6002ed09cd24186258892fcfca64b6 <4262b91e08e74cb5209ea737c554cf983d332382

Linux patch: 6.12.111

Linux patch: 0

Linux 6.7

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Sep 25, 2026 - 11:02 EUVD

CVE Published

Sep 25, 2026 - 10:22 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 91% exploitable

Data Quality

2 sources

Confidence: Low

EUVD

CVE.org

EPSS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.