Three severe remotely exploitable vulnerabilities have been discovered in the Linux kernel: NVMe/TCP target (CVE-2026-64535), SMC sockets (CVE-2026-64541), and SCTP (CVE-2026-64551). These vulnerabilities have high CVSS scores; specifically, CVE-2026-64535 and CVE-2026-64541 are rated "CRITICAL" with CVSS 9.8. These vulnerabilities do not require privileges and can lead to Denial of Service (DoS), reading uninitialized kernel memory, and even arbitrary code execution through remote exploitation. While no 0-day attacks or public exploit code for these vulnerabilities have been confirmed yet, a prompt kernel update is strongly recommended.
Immediate Actions to Take
- ✓Update to the latest stable kernel provided by the official repository of your Linux distribution.
- ✓Temporarily suspend the use of related services (NVMe/TCP, SMC, SCTP) or strengthen access restrictions until the update is applied.
- ✓Check if the system has been compromised, looking for suspicious network communications or abnormal logs.
Vulnerability Overview and Scope of Impact
This announcement reports that a total of 33 Linux kernel CVEs were disclosed between July 26 and August 1, 2026, all of which have been fixed in stable releases. Among them, the following three remotely exploitable vulnerabilities are particularly alarming:
CVE-2026-64535 is a vulnerability in the NVMe/TCP target, with a CVSS score of 9.8. If exploited, remote attackers could compromise the system without privileges.
CVE-2026-64541 is a vulnerability in SMC sockets, also with a CVSS score of 9.8. Similarly, it can be exploited remotely without privileges.
CVE-2026-64551 is a vulnerability in SCTP, with a CVSS score of 9.1. A remote SCTP peer may be able to read uninitialized kernel memory.
Specific Impact and Attack Scenarios
These vulnerabilities are particularly concerning in cloud environments and data centers. Attackers could exploit network-facing components like NVMe/TCP, SMC, and SCTP to infiltrate systems without authentication, disrupt services, or steal sensitive kernel memory information. Specifically, the NVMe/TCP and SMC socket vulnerabilities can be exploited remotely without privileges, exposing systems with these features enabled to widespread risk. The SCTP vulnerability also poses a risk of memory information leakage from remote peers.
Impact by Major Distribution
All of these CVEs have already received fixes in stable releases. Depending on your Linux distribution, consider updating to the latest stable kernel as follows:
The latest secure releases for each branch are: 5.10.262, 5.15.213, 6.1.180, 6.6.147, 6.12.100, 6.18.41, 7.1.5, or mainline 7.2-rc5. Additionally, hosts using the End-of-Life 7.0 kernel must migrate to 7.1.5. Please check the official security advisories for specific patch availability for each distribution (e.g., Ubuntu, Debian, RHEL, AlmaLinux, etc.).
Response Procedures and Verification Methods
You can check your kernel version with the `uname -r` command. Update to the latest available kernel package using your distribution's package manager (e.g., `apt update && apt upgrade` for Debian/Ubuntu, `yum update` or `dnf update` for RHEL/AlmaLinux). After updating, you must reboot the system for the changes to take effect.
📦