Vulnary
← back to the feed
Critical· 9.8official fix available

CVE-2026-64046

CVE-2026-64046 is a critical vulnerability in the Linux kernel's TLS handling that incorrectly builds scatterlist chains in plain text SG, which is illegal input to crypto. The issue has been resolved in the kernel source by preventing chain-after-chain links when end = 0. No specific affected product versions, CISA KEV action, or public exploit are listed in the provided data.

publishedJul 19, 2026
last modifiedJul 30, 2026
sourcesNVD
severity · cvss
9.8
critical · how bad it is
exploitation · epss
<1%
41th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 19, 2026

An official fix is available, so this entry is kept for 30 days and then removed automatically.

01

Who is affected

Systems running the Linux kernel with the vulnerable TLS plain text SG code path are potentially affected; no specific CPE versions are listed in the source data.

02

Real-world impact

A remote, unauthenticated attacker could exploit this flaw to cause high impact to confidentiality, integrity, and availability of a vulnerable Linux system using the affected TLS code.

03

Why this severity

CVSS 9.8 critical means the flaw is network-exploitable, requires no privileges or user interaction, and can fully compromise the system.

04

What to do about it

official fix available
recommended steps
  1. 01Deploy the Linux kernel build that includes the fix described in the NVD entry, identified by the change titled 'net: tls: prevent chain-after-chain in plain text SG'.

NVD-referenced vendor advisory (Linux kernel commit stating 'the following vulnerability has been resolved')

05

Timeline

  1. Jul 19, 2026 · 14d ago
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Jul 20, 2026 · 13d ago
    Official fix available
    A vendor patch or mitigation now exists — see the remediation steps above.
  3. Jul 30, 2026 · 3d ago
    Advisory updated
    The NVD record was last revised.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07

References & advisories

NVD advisory ↗Search advisories ↗
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →