CyberSecBulletin
CVE-2026-64529NVD status: Analyzed

Linux: Active Debug Code

Published Updated By the CyberSecBulletin desk

CVE-2026-64529 is a high-severity active debug code vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 071590a44cbc38483fceb1ab943363ec26868e1b, 1de076f43e64bf65fbe7280a269c70e0e60518df, a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.18% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 071590a44cbc38483fceb1ab943363ec26868e1b or 1de076f43e64bf65fbe7280a269c70e0e60518df or a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a or 6848a6e39cac44fdb7cb88f0f777df62172d1551, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.260 or 5.15.211 or 6.1.177 or 6.6.144, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxd8cba25d2c68992a6e7c1d329b690a9ebe01167d up to, but not including, 071590a44cbc38483fceb1ab943363ec26868e1b; d8cba25d2c68992a6e7c1d329b690a9ebe01167d up to, but not including, 1de076f43e64bf65fbe7280a269c70e0e60518df; d8cba25d2c68992a6e7c1d329b690a9ebe01167d up to, but not including, a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a; d8cba25d2c68992a6e7c1d329b690a9ebe01167d up to, but not including, 6848a6e39cac44fdb7cb88f0f777df62172d1551; d8cba25d2c68992a6e7c1d329b690a9ebe01167d up to, but not including, b1ea97076bd0a5196290deba172034e480646727; d8cba25d2c68992a6e7c1d329b690a9ebe01167d up to, but not including, b8ebf008696de1ec08c90d51f94d7e40bd448be1; d8cba25d2c68992a6e7c1d329b690a9ebe01167d up to, but not including, de2cc38489b629927910b1aeff69bba7bd5c6f1b; d8cba25d2c68992a6e7c1d329b690a9ebe01167d up to, but not including, 3ae49dd04dbb11fb73f17f58a982dba128abe83a; and 2 more ranges071590a44cbc38483fceb1ab943363ec26868e1b, 1de076f43e64bf65fbe7280a269c70e0e60518df, a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a, 6848a6e39cac44fdb7cb88f0f777df62172d1551, b1ea97076bd0a5196290deba172034e480646727, b8ebf008696de1ec08c90d51f94d7e40bd448be1
LinuxLinux Kernel3.17 up to, but not including, 5.10.260; 5.11 up to, but not including, 5.15.211; 5.16 up to, but not including, 6.1.177; 6.2 up to, but not including, 6.6.144; 6.7 up to, but not including, 6.12.95; 6.13 up to, but not including, 6.18.37; 6.19 up to, but not including, 7.0.14; 7.1 up to, but not including, 7.1.25.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.37

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs for device configuration, start, stop, status query and enumeration. These IOCTLs are not part of any public uAPI header and have no known in-tree or out-of-tree users. Device lifecycle is already managed via sysfs. The ioctl interface also increases the attack surface and is the subject of a number of bug reports. Remove the character device, the IOCTL definitions, and the related data structures (adf_dev_status_info, adf_user_cfg_key_val, adf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused adf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal module_init/module_exit hooks for workqueue, AER, and crypto/compression algorithm registration. Clean up leftover dead code that was only reachable from the removed IOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(), adf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(), adf_get_vf_real_id() and the unused ADF_CFG macros. Additionally, drop the entry associated to QAT IOCTLs in ioctl-number.rst.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Active Debug Code

The product is released with debugging code still enabled or active.

How developers prevent this class of flaw

  • Remove debug code before deploying the application.

More Active Debug Code vulnerabilities (CWE-489)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Active Debug Code vulnerabilities

Spotted an error? Tell us.