CyberSecBulletin
CVE-2026-64219NVD status: Modified

Linux: Uncontrolled Recursion

Published Updated By the CyberSecBulletin desk

CVE-2026-64219 is a high-severity uncontrolled recursion vulnerability in Linux, with a CVSS 3.1 base score of 7.0 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions d6590e3f766e3111dd1beaf88b9384d117acfa6b, 16a5fa57565afb6bf37e18129921c270c93d8e2b, 90c398e822ca76e40548df0c061dd4f93ea92d71 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.17% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to d6590e3f766e3111dd1beaf88b9384d117acfa6b or 16a5fa57565afb6bf37e18129921c270c93d8e2b or 90c398e822ca76e40548df0c061dd4f93ea92d71 or 3265f3ed373fb8048be713aadcdf702579a0e53d, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.15.209 or 6.1.175 or 6.6.142 or 6.12.92, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 up to, but not including, d6590e3f766e3111dd1beaf88b9384d117acfa6b; 4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 up to, but not including, 16a5fa57565afb6bf37e18129921c270c93d8e2b; 4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 up to, but not including, 90c398e822ca76e40548df0c061dd4f93ea92d71; 4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 up to, but not including, 3265f3ed373fb8048be713aadcdf702579a0e53d; 4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 up to, but not including, 1ecde19bfce6535bffddad1139ff466b6d401b8e; 4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 up to, but not including, 1c8c6e912f2945b2a3e669afca6b52174b88e86e; 4f8e37dbaf584de6d38f58b3000b0bfd7eaf2ff6 up to, but not including, 6c92f6d9600efa3ef0d9e560a2b52776d9803c29; 5.13d6590e3f766e3111dd1beaf88b9384d117acfa6b, 16a5fa57565afb6bf37e18129921c270c93d8e2b, 90c398e822ca76e40548df0c061dd4f93ea92d71, 3265f3ed373fb8048be713aadcdf702579a0e53d, 1ecde19bfce6535bffddad1139ff466b6d401b8e, 1c8c6e912f2945b2a3e669afca6b52174b88e86e
LinuxLinux Kernel5.13 up to, but not including, 5.15.209; 5.16 up to, but not including, 6.1.175; 6.2 up to, but not including, 6.6.142; 6.7 up to, but not including, 6.12.92; 6.13 up to, but not including, 6.18.34; 6.19 up to, but not including, 7.0.11; 7.15.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
HighSuccess depends on conditions outside the attacker's control.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async [Why&How] dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(), which is a no-op in release builds. If a caller ever passes length > 16 this results in a stack buffer overflow via memcpy. Additionally, link_index is used to dereference dc->links[] without bounds checking against dc->link_count, risking an out-of-bounds access. Replace the ASSERT with a hard runtime check that returns false when payload->length exceeds the destination buffer size, and add a bounds check for link_index before it is used. (cherry picked from commit ba4caa9fecdf7a38f98c878ad05a8a64148b6881)

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

How developers prevent this class of flaw

  • Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.

More Uncontrolled Recursion vulnerabilities (CWE-674)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Uncontrolled Recursion vulnerabilities

Spotted an error? Tell us.