CVE-2026-64584 (GCVE-0-2026-64584)
Vulnerability from cvelistv5 – Published: 2026-08-06 07:06 – Updated: 2026-08-19 16:29
VLAI
EPSS
VEX
Title
usb: gadget: f_midi: cancel pending IN work before freeing the midi object
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_midi: cancel pending IN work before freeing the midi object
The f_midi driver embeds a work item (midi->work) whose handler,
f_midi_in_work(), dereferences the enclosing struct f_midi through
container_of(). This work is armed from two sites: f_midi_complete(),
on a normal IN-endpoint completion, and f_midi_in_trigger(), on an ALSA
rawmidi output-stream start.
Neither f_midi_disable() nor f_midi_unbind() cancels midi->work.
f_midi_disable() only disables the endpoints and drains the in_req_fifo;
it does not synchronize the work item, and the sound card is released
asynchronously to the final free of the midi object.
The midi object is reference-counted (midi->free_ref) and is freed in
f_midi_free() only once both the usb_function reference and the rawmidi
private_data reference have been dropped. In f_midi_unbind(),
f_midi_disable() runs before the sound card is released, so while the
USB endpoints are already disabled the rawmidi device is still usable by
an open substream. A concurrent userspace write on such a substream can
reach f_midi_in_trigger() and queue midi->work again after
f_midi_disable() has returned. A work item armed this way may still be
pending when the last reference drops and f_midi_free() proceeds to
kfree(midi), letting f_midi_in_work() dereference the struct after it
has been freed, a use-after-free.
For this reason cancelling midi->work in f_midi_disable() would not be
sufficient: the ALSA trigger path can rearm the work after disable()
returns. Cancelling at the refcount-zero free site is the boundary
after which neither arming source can survive, because by then both
references that keep the midi object alive have been dropped: the USB
endpoints are already disabled and the rawmidi device has been released.
Fix this by calling cancel_work_sync(&midi->work) in the refcount-zero
block of f_midi_free(), before the embedded work_struct is freed along
with the rest of the structure. opts->lock is a sleeping mutex, so
calling cancel_work_sync() under it is permitted, and the handler takes
midi->transmit_lock rather than opts->lock, so no self-deadlock can
occur while it waits for a running instance of the work to finish.
This issue was found by an in-house static analysis tool.
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
3635523e9b96213969693c320302d536774d8e9b , < f3c6f2c38062703d3dc7f86958bb0790c6959add
(git)
Affected: 8653d71ce3763aedcf3d2331f59beda3fecd79e4 , < df18150126f66817e4d3f79f309e9c92d6ff384e (git) Affected: 8653d71ce3763aedcf3d2331f59beda3fecd79e4 , < 620955b222c47332297d6bf38f78541aa699238a (git) Affected: 8653d71ce3763aedcf3d2331f59beda3fecd79e4 , < 380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9 (git) Affected: 8653d71ce3763aedcf3d2331f59beda3fecd79e4 , < 87bc316dd6fc90072297c635e10b9aa6075ecda1 (git) Affected: 8653d71ce3763aedcf3d2331f59beda3fecd79e4 , < f45089eaad0a083d71d84ff175741d7e157d9b69 (git) Affected: 8653d71ce3763aedcf3d2331f59beda3fecd79e4 , < ac9a51d910bb7465c554c45320cb6c09f3d0b49d (git) Affected: 8653d71ce3763aedcf3d2331f59beda3fecd79e4 , < 5650c18d93a1db7e27cb5a40b394747eb4686d5b (git) Affected: 89019ab7a64fcdf98a2ba7799e5c6aff58d4a05d (git) Affected: 5.10.235 , < 5.10.265 (semver) Affected: 5.4.291 , < 5.5 (semver) |
guessed | |
| Linux | Linux |
Affected:
5.12
Unaffected: 0 , < 5.12 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.148 , ≤ 6.6.* (semver) Unaffected: 6.12.101 , ≤ 6.12.* (semver) Unaffected: 6.18.42 , ≤ 6.18.* (semver) Unaffected: 7.1.6 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_midi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f3c6f2c38062703d3dc7f86958bb0790c6959add",
"status": "affected",
"version": "3635523e9b96213969693c320302d536774d8e9b",
"versionType": "git"
},
{
"lessThan": "df18150126f66817e4d3f79f309e9c92d6ff384e",
"status": "affected",
"version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
"versionType": "git"
},
{
"lessThan": "620955b222c47332297d6bf38f78541aa699238a",
"status": "affected",
"version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
"versionType": "git"
},
{
"lessThan": "380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9",
"status": "affected",
"version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
"versionType": "git"
},
{
"lessThan": "87bc316dd6fc90072297c635e10b9aa6075ecda1",
"status": "affected",
"version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
"versionType": "git"
},
{
"lessThan": "f45089eaad0a083d71d84ff175741d7e157d9b69",
"status": "affected",
"version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
"versionType": "git"
},
{
"lessThan": "ac9a51d910bb7465c554c45320cb6c09f3d0b49d",
"status": "affected",
"version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
"versionType": "git"
},
{
"lessThan": "5650c18d93a1db7e27cb5a40b394747eb4686d5b",
"status": "affected",
"version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
"versionType": "git"
},
{
"status": "affected",
"version": "89019ab7a64fcdf98a2ba7799e5c6aff58d4a05d",
"versionType": "git"
},
{
"lessThan": "5.10.265",
"status": "affected",
"version": "5.10.235",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.291",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_midi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.10.235",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.291",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_midi: cancel pending IN work before freeing the midi object\n\nThe f_midi driver embeds a work item (midi-\u003ework) whose handler,\nf_midi_in_work(), dereferences the enclosing struct f_midi through\ncontainer_of(). This work is armed from two sites: f_midi_complete(),\non a normal IN-endpoint completion, and f_midi_in_trigger(), on an ALSA\nrawmidi output-stream start.\n\nNeither f_midi_disable() nor f_midi_unbind() cancels midi-\u003ework.\nf_midi_disable() only disables the endpoints and drains the in_req_fifo;\nit does not synchronize the work item, and the sound card is released\nasynchronously to the final free of the midi object.\n\nThe midi object is reference-counted (midi-\u003efree_ref) and is freed in\nf_midi_free() only once both the usb_function reference and the rawmidi\nprivate_data reference have been dropped. In f_midi_unbind(),\nf_midi_disable() runs before the sound card is released, so while the\nUSB endpoints are already disabled the rawmidi device is still usable by\nan open substream. A concurrent userspace write on such a substream can\nreach f_midi_in_trigger() and queue midi-\u003ework again after\nf_midi_disable() has returned. A work item armed this way may still be\npending when the last reference drops and f_midi_free() proceeds to\nkfree(midi), letting f_midi_in_work() dereference the struct after it\nhas been freed, a use-after-free.\n\nFor this reason cancelling midi-\u003ework in f_midi_disable() would not be\nsufficient: the ALSA trigger path can rearm the work after disable()\nreturns. Cancelling at the refcount-zero free site is the boundary\nafter which neither arming source can survive, because by then both\nreferences that keep the midi object alive have been dropped: the USB\nendpoints are already disabled and the rawmidi device has been released.\n\nFix this by calling cancel_work_sync(\u0026midi-\u003ework) in the refcount-zero\nblock of f_midi_free(), before the embedded work_struct is freed along\nwith the rest of the structure. opts-\u003elock is a sleeping mutex, so\ncalling cancel_work_sync() under it is permitted, and the handler takes\nmidi-\u003etransmit_lock rather than opts-\u003elock, so no self-deadlock can\noccur while it waits for a running instance of the work to finish.\n\nThis issue was found by an in-house static analysis tool."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is reached by local configfs UDC clear or function unlink (unregister_gadget \u2192 f_midi_unbind/disable) plus ALSA rawmidi write/close on /dev/snd/midi*; no USB host traffic or cable access is required, and dummy_hcd suffices, matching other gadget teardown UAFs scored AV:L.\nAC:L - The attacker controls both sides of the race: opening/writing the rawmidi substream to queue midi-\u003ework via f_midi_in_trigger after disable, and forcing unbind plus dropping the last free_ref via configfs unlink/close, so the window is freely repeatable.\nPR:L - Exploitation needs access to the gadget configfs tree and/or the ALSA MIDI node; both are routinely delegated to non-root system/audio accounts on Android and embedded MIDI gadgets, with no capability check on the rawmidi write or UDC store path itself.\nUI:N - The attacker performs the full sequence\u2014configfs unbind/unlink, rawmidi write to rearm work, and close to free the midi object\u2014without any action by another user or administrator.\nS:U - The use-after-free corrupts kernel heap within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - f_midi_in_work() container_of()s the freed embedded work_struct and then reads midi-\u003ein_ep, fifo, and port/substream fields; reclaiming the freed f_midi slab yields a classic UAF read/disclosure primitive.\nI:H - Post-free f_midi_transmit()/f_midi_drop_out_substreams() write through the reclaimed object (port state, kfifo, snd_rawmidi_drop_output), giving a heap write-after-free primitive suitable for control-flow hijack.\nA:H - Dereferencing the freed f_midi from system_highpri_wq reliably produces KASAN reports, oops, or kernel panic even without full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:29:12.890Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f3c6f2c38062703d3dc7f86958bb0790c6959add"
},
{
"url": "https://git.kernel.org/stable/c/df18150126f66817e4d3f79f309e9c92d6ff384e"
},
{
"url": "https://git.kernel.org/stable/c/620955b222c47332297d6bf38f78541aa699238a"
},
{
"url": "https://git.kernel.org/stable/c/380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9"
},
{
"url": "https://git.kernel.org/stable/c/87bc316dd6fc90072297c635e10b9aa6075ecda1"
},
{
"url": "https://git.kernel.org/stable/c/f45089eaad0a083d71d84ff175741d7e157d9b69"
},
{
"url": "https://git.kernel.org/stable/c/ac9a51d910bb7465c554c45320cb6c09f3d0b49d"
},
{
"url": "https://git.kernel.org/stable/c/5650c18d93a1db7e27cb5a40b394747eb4686d5b"
}
],
"title": "usb: gadget: f_midi: cancel pending IN work before freeing the midi object",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64584",
"datePublished": "2026-08-06T07:06:25.953Z",
"dateReserved": "2026-07-19T15:36:31.798Z",
"dateUpdated": "2026-08-19T16:29:12.890Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-64584",
"date": "2026-09-30",
"epss": "0.00171",
"percentile": "0.05824"
},
"microsoft_vex": {
"current_release_date": "2026-08-09T01:43:45.000Z",
"cve": "CVE-2026-64584",
"id": "msrc_CVE-2026-64584",
"initial_release_date": "2026-08-07T01:16:16.000Z",
"product_status:fixed": "1",
"product_status:known_affected": "1",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "usb: gadget: f_midi: cancel pending IN work before freeing the midi object",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64584.json",
"version": "2"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_midi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f3c6f2c38062703d3dc7f86958bb0790c6959add",
"status": "affected",
"version": "3635523e9b96213969693c320302d536774d8e9b",
"versionType": "git"
},
{
"lessThan": "df18150126f66817e4d3f79f309e9c92d6ff384e",
"status": "affected",
"version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
"versionType": "git"
},
{
"lessThan": "620955b222c47332297d6bf38f78541aa699238a",
"status": "affected",
"version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
"versionType": "git"
},
{
"lessThan": "380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9",
"status": "affected",
"version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
"versionType": "git"
},
{
"lessThan": "87bc316dd6fc90072297c635e10b9aa6075ecda1",
"status": "affected",
"version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
"versionType": "git"
},
{
"lessThan": "f45089eaad0a083d71d84ff175741d7e157d9b69",
"status": "affected",
"version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
"versionType": "git"
},
{
"lessThan": "ac9a51d910bb7465c554c45320cb6c09f3d0b49d",
"status": "affected",
"version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
"versionType": "git"
},
{
"lessThan": "5650c18d93a1db7e27cb5a40b394747eb4686d5b",
"status": "affected",
"version": "8653d71ce3763aedcf3d2331f59beda3fecd79e4",
"versionType": "git"
},
{
"status": "affected",
"version": "89019ab7a64fcdf98a2ba7799e5c6aff58d4a05d",
"versionType": "git"
},
{
"lessThan": "5.10.265",
"status": "affected",
"version": "5.10.235",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.291",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_midi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_midi: cancel pending IN work before freeing the midi object\n\nThe f_midi driver embeds a work item (midi-\u003ework) whose handler,\nf_midi_in_work(), dereferences the enclosing struct f_midi through\ncontainer_of(). This work is armed from two sites: f_midi_complete(),\non a normal IN-endpoint completion, and f_midi_in_trigger(), on an ALSA\nrawmidi output-stream start.\n\nNeither f_midi_disable() nor f_midi_unbind() cancels midi-\u003ework.\nf_midi_disable() only disables the endpoints and drains the in_req_fifo;\nit does not synchronize the work item, and the sound card is released\nasynchronously to the final free of the midi object.\n\nThe midi object is reference-counted (midi-\u003efree_ref) and is freed in\nf_midi_free() only once both the usb_function reference and the rawmidi\nprivate_data reference have been dropped. In f_midi_unbind(),\nf_midi_disable() runs before the sound card is released, so while the\nUSB endpoints are already disabled the rawmidi device is still usable by\nan open substream. A concurrent userspace write on such a substream can\nreach f_midi_in_trigger() and queue midi-\u003ework again after\nf_midi_disable() has returned. A work item armed this way may still be\npending when the last reference drops and f_midi_free() proceeds to\nkfree(midi), letting f_midi_in_work() dereference the struct after it\nhas been freed, a use-after-free.\n\nFor this reason cancelling midi-\u003ework in f_midi_disable() would not be\nsufficient: the ALSA trigger path can rearm the work after disable()\nreturns. Cancelling at the refcount-zero free site is the boundary\nafter which neither arming source can survive, because by then both\nreferences that keep the midi object alive have been dropped: the USB\nendpoints are already disabled and the rawmidi device has been released.\n\nFix this by calling cancel_work_sync(\u0026midi-\u003ework) in the refcount-zero\nblock of f_midi_free(), before the embedded work_struct is freed along\nwith the rest of the structure. opts-\u003elock is a sleeping mutex, so\ncalling cancel_work_sync() under it is permitted, and the handler takes\nmidi-\u003etransmit_lock rather than opts-\u003elock, so no self-deadlock can\noccur while it waits for a running instance of the work to finish.\n\nThis issue was found by an in-house static analysis tool."
}
],
"id": "CVE-2026-64584",
"lastModified": "2026-08-19T17:20:18.703",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
]
},
"published": "2026-08-06T08:16:33.543",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/380b4bef46c2eb260c7a9c6bb2c5be33ce5a38f9"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/5650c18d93a1db7e27cb5a40b394747eb4686d5b"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/620955b222c47332297d6bf38f78541aa699238a"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/87bc316dd6fc90072297c635e10b9aa6075ecda1"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/ac9a51d910bb7465c554c45320cb6c09f3d0b49d"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/df18150126f66817e4d3f79f309e9c92d6ff384e"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/f3c6f2c38062703d3dc7f86958bb0790c6959add"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/f45089eaad0a083d71d84ff175741d7e157d9b69"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-09-22T16:50:04Z",
"cve": "CVE-2026-64584",
"id": "CVE-2026-64584",
"initial_release_date": "2026-08-06T23:56:00Z",
"product_status:first_fixed": "60",
"product_status:known_affected": "528",
"product_status:known_not_affected": "203",
"product_status:recommended": "111",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-64584",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64584.json",
"version": "10"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…