Important correction: The previous article labeled CVE-2026-64535, CVE-2026-64541, and CVE-2026-64551 collectively as CVSS 9.8 remote code execution vulnerabilities. The official Linux announcements do not support that conclusion, so the RCE and score claims are withdrawn.
What the three issues are
- ▸CVE-2026-64535: a potential use-after-free in the NVMe/TCP target when a digest mismatch occurs
- ▸CVE-2026-64541: a use-after-free in SMC networking
- ▸CVE-2026-64551: an SCTP stale-cookie length-validation issue
A memory-safety flaw does not by itself prove Internet-reachable code execution. Reachability, configuration, required access, and impact must be evaluated for each CVE and distribution.
[Added 2026-08-23] After this article was published, kernel.org (the CNA) assigned CVE-2026-64535 a CVSS v3.1 base score of 9.8 CRITICAL, which is the score shown above. CVE-2026-64541 and CVE-2026-64551 still have no published CVSS score, so there is still no basis for treating all three as equally severe. A base score describes potential impact; it is not evidence that Internet-reachable exploitation has been demonstrated. The correction this article makes still stands.
Response
- ✓Check the Linux distribution's advisory for a backported fix
- ✓Prioritize hosts using the NVMe/TCP target, SMC, or SCTP
- ✓Install the vendor's fixed kernel and reboot where required
- ✓Consider disabling unused modules or services until maintenance, after assessing operational impact
CVE-2026-64535 fixed series
The Linux announcement lists fixes in series including 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1. Enterprise distributions commonly backport fixes, so use the distribution package advisory rather than comparing uname versions alone.
uname -r
lsmod | grep -E 'nvmet_tcp|smc|sctp'