CVE-2026-64523
A critical flaw in the Linux kernel’s handshake handling could let an attacker take full control of a system. The bug involves a missing reference to a socket file, which can be exploited to crash or hijack kernel operations. The issue has been fixed in the kernel code.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
All Linux kernel installations that have not applied the latest security update for CVE-2026-64523.
Real-world impact
An attacker could use this vulnerability to execute arbitrary code with kernel privileges, effectively taking over the affected machine and compromising data confidentiality, integrity, and availability.
Why this severity
The CVSS score of 9.8 reflects a network‑accessible flaw that requires no user interaction and allows an attacker to fully compromise the system. The high impact on confidentiality, integrity, and availability, combined with low attack complexity, drives the score to critical.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the fix for CVE-2026-64523.
- 02Reboot the system to load the updated kernel.
NVD description indicates the vulnerability has been resolved in the Linux kernel.
Timeline
- Jul 25, 2026 · 7d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 27, 2026 · 5d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.