CyberSecBulletin
CVE-2026-64048NVD status: Modified

Linux: NULL Pointer Dereference

Published Updated By the CyberSecBulletin desk

CVE-2026-64048 is a high-severity NULL pointer dereference vulnerability in Linux, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 903f7688ffeb9b323d70652c01f554bd4ba2a3d6, dd2f9dd83c68abd7ba7ded7075290b016cb7ecd0, 6927cacf2b10d4fa80c1a2d407512ef9397c59c6 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.5% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 903f7688ffeb9b323d70652c01f554bd4ba2a3d6 or dd2f9dd83c68abd7ba7ded7075290b016cb7ecd0 or 6927cacf2b10d4fa80c1a2d407512ef9397c59c6 or d38ba387244e5c5f7db3e11ea98bc2c7beccb0c0, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.266 or 5.15.217 or 6.1.175 or 6.6.142, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxa7c9c5f4af7f6098da68705fc5d86565d0728ef7 up to, but not including, 903f7688ffeb9b323d70652c01f554bd4ba2a3d6; a7c9c5f4af7f6098da68705fc5d86565d0728ef7 up to, but not including, dd2f9dd83c68abd7ba7ded7075290b016cb7ecd0; a7c9c5f4af7f6098da68705fc5d86565d0728ef7 up to, but not including, 6927cacf2b10d4fa80c1a2d407512ef9397c59c6; a7c9c5f4af7f6098da68705fc5d86565d0728ef7 up to, but not including, d38ba387244e5c5f7db3e11ea98bc2c7beccb0c0; a7c9c5f4af7f6098da68705fc5d86565d0728ef7 up to, but not including, 53eb7bd09aace72fa17510d80e0caf5ca058c231; a7c9c5f4af7f6098da68705fc5d86565d0728ef7 up to, but not including, afa9036b8c9963947b487c36e332df6a42c96fcb; a7c9c5f4af7f6098da68705fc5d86565d0728ef7 up to, but not including, 65edb3b0822cfe5041be8fbabebd57e2e5ad9f4e; a7c9c5f4af7f6098da68705fc5d86565d0728ef7 up to, but not including, 277740023def559a4a2ddc3e8e784ee37a0f16a9; and 1 more ranges903f7688ffeb9b323d70652c01f554bd4ba2a3d6, dd2f9dd83c68abd7ba7ded7075290b016cb7ecd0, 6927cacf2b10d4fa80c1a2d407512ef9397c59c6, d38ba387244e5c5f7db3e11ea98bc2c7beccb0c0, 53eb7bd09aace72fa17510d80e0caf5ca058c231, afa9036b8c9963947b487c36e332df6a42c96fcb
LinuxLinux Kernel5.10 up to, but not including, 5.10.266; 5.11 up to, but not including, 5.15.217; 5.16 up to, but not including, 6.1.175; 6.2 up to, but not including, 6.6.142; 6.7 up to, but not including, 6.12.92; 6.13 up to, but not including, 6.18.34; 6.19 up to, but not including, 7.0.11; 7.15.10.266, 5.15.217, 6.1.175, 6.6.142, 6.12.92, 6.18.34

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot On the SMC-D client, slot 0 of ini->ism_dev[]/ini->ism_chid[] is reserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt() populates V2 entries starting at index 1, so when no V1 device is selected slot 0 is left in its kzalloc()'ed state with ism_dev[0] == NULL and ism_chid[0] == 0. smc_v2_determine_accepted_chid() then matches the peer's CHID against the array starting from index 0 using the CHID alone. A malicious peer replying to a SMC-Dv2-only proposal with d1.chid == 0 matches the empty slot, ini->ism_selected becomes 0, and the subsequent ism_dev[0]->lgr_lock dereference in smc_conn_create() faults at offsetof(struct smcd_dev, lgr_lock) == 0x68: BUG: KASAN: null-ptr-deref in _raw_spin_lock_bh+0x79/0xe0 Write of size 4 at addr 0000000000000068 by task exploit/144 Call Trace: _raw_spin_lock_bh smc_conn_create (net/smc/smc_core.c:1997) __smc_connect (net/smc/af_smc.c:1447) smc_connect (net/smc/af_smc.c:1720) __sys_connect __x64_sys_connect do_syscall_64 Require ism_dev[i] to be non-NULL before accepting a CHID match.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

How developers prevent this class of flaw

  • For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
  • Select a programming language that is not susceptible to these issues.
  • Check the results of all functions that return a value and verify that the value is non-null before acting upon it.

More NULL Pointer Dereference vulnerabilities (CWE-476)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent NULL Pointer Dereference vulnerabilities

Spotted an error? Tell us.