Important correction: The previous article labeled CVE-2026-64535, CVE-2026-64541, and CVE-2026-64551 collectively as CVSS 9.8 remote code execution vulnerabilities. The official Linux announcements do not support that conclusion, so the RCE and score claims are withdrawn.
What the three issues are
- ▸CVE-2026-64535: a potential use-after-free in the NVMe/TCP target when a digest mismatch occurs
- ▸CVE-2026-64541: a use-after-free in SMC networking
- ▸CVE-2026-64551: an SCTP stale-cookie length-validation issue
A memory-safety flaw does not by itself prove Internet-reachable code execution. Reachability, configuration, required access, and impact must be evaluated for each CVE and distribution.
Response
- ✓Check the Linux distribution's advisory for a backported fix
- ✓Prioritize hosts using the NVMe/TCP target, SMC, or SCTP
- ✓Install the vendor's fixed kernel and reboot where required
- ✓Consider disabling unused modules or services until maintenance, after assessing operational impact
CVE-2026-64535 fixed series
The Linux announcement lists fixes in series including 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1. Enterprise distributions commonly backport fixes, so use the distribution package advisory rather than comparing uname versions alone.
bash
uname -r
lsmod | grep -E 'nvmet_tcp|smc|sctp'Primary sources
参考リンク / References
Amazon で関連書籍・ツールを検索
Linux server security operations
Amazonで探す →（アソシエイトリンク）