The Linux kernel project published 763 Linux kernel CVEs in the week of 18 to 25 July 2026, almost all in one large batch on 25 July. This is a very high-volume week, not a quiet one. Every CVE is already fixed in a stable release, and there is no 0-day and no public exploit code. The action is to update your kernel to the newest release for your branch. The most serious are network-reachable and should be scheduled first: CVE-2026-63984 (IPv6 RPL, CVSS 9.8), CVE-2026-64024 (TCP sequence-number prediction, CVSS 9.4), and CVE-2026-63938 (KVM SEV guest-to-host, CVSS 9.3). The newest safe release per branch is 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or mainline 7.2-rc4. The 7.0 series has reached end of life; move 7.0 systems to 7.1.5.
This is one of the largest single batches the kernel CVE project has published. There are 763 CVEs in total this week. Most are narrow driver and filesystem fixes, so this advisory does not list them all. Instead it lists the high-impact ones: the network-reachable bugs, the guest-to-host bugs, and the unprivileged-local memory-corruption bugs, grouped by device type. Which of them matter for you depends on what your product runs and how it is configured, so treat the network-reachable ones as the priority everywhere. This advisory gives the version to install first. It then explains which Linux kernel CVEs matter for mobile and automotive, embedded and IoT, cloud and datacenter, and medical devices. Unlike some recent weeks, the old 5.10 and 5.15 LTS branches are affected this week, so frozen products are not exempt.
The one action: update to the newest release for your branch
Run uname -r to see your current kernel version. Compare it with the target for your branch in the table below, then update to that release. Because the batch is very large, the safe move is to install the current release for your branch, which carries the whole batch. After that, use the per-device sections to decide what to test and how urgently.
| Stable branch | Update to at least | Notes |
|---|---|---|
| 5.10 LTS | 5.10.261 | Affected this week. Some bugs (for example CVE-2026-63984, CVE-2026-64114, CVE-2026-64469) reach back this far. |
| 5.15 LTS | 5.15.212 | Affected this week, same as 5.10. |
| 6.1 LTS | 6.1.178 | Clears the batch fixes backported to 6.1. |
| 6.6 LTS | 6.6.145 | Clears the batch fixes backported to 6.6. |
| 6.12 LTS | 6.12.97 | Clears the batch fixes backported to 6.12. |
| 6.18 LTS | 6.18.40 | Batch fixes are present by 6.18.39; 6.18.40 is the current release. |
| 7.1 stable | 7.1.5 | Batch fixes are present by 7.1.4; 7.1.5 is the current release. |
| mainline | 7.2-rc4 | All merged. |
| 7.0 | end of life — move to 7.1.5 | 7.0 is retired (last release 7.0.14, 27 June 2026). It does not receive this batch. Migrate to 7.1. |
Every active branch is affected this week, so there is no “not affected” branch to list. The one change from earlier editions is 7.0: it is now end of life and must be replaced with 7.1, not merely updated.
Mobile and automotive
The Bluetooth fixes are the first thing to review for phones and car head units. CVE-2026-63947 is an out-of-bounds read in the Bluetooth HID path (net/bluetooth/hidp/core.c), rated CVSS 8.8 and reachable from an adjacent device over the air. CVE-2026-64434 is a use-after-free in the L2CAP channel timeout, CVE-2026-64403 is an out-of-bounds read when parsing an L2CAP configuration option, and CVE-2026-64407 is an out-of-bounds firmware read in the NXP UART Bluetooth driver. These are gated by CONFIG_BT (and the HIDP and NXP options), which are built on most phones and infotainment units.
The Wi‑Fi fixes matter next. CVE-2026-64030 (CVSS 8.8) and CVE-2026-64515 are out-of-bounds problems in mac80211 multi-link handling that a crafted frame from a nearby transmitter can reach; they need CONFIG_MAC80211. On Android phones and Android Automotive systems, CVE-2026-64469 is a use-after-free in the binder IPC driver (CONFIG_ANDROID_BINDER_IPC), reachable by local app code. Many mobile and automotive SoCs are Arm, so also apply CVE-2026-63875 (CVSS 7.8), a stale-TLB bug fixed by flushing the walk cache when unsharing page-middle-directory tables. Devices with a touch controller should include CVE-2026-64367, a stack buffer overflow in the Goodix SPI HID driver. The two network criticals, CVE-2026-63984 (IPv6 RPL) and CVE-2026-64024 (TCP), apply to any connected device. The KVM guest-to-host bugs apply only if the platform runs virtual machines.
Embedded and IoT
CVE-2026-63984 deserves special attention for IoT. It is a CVSS 9.8 out-of-bounds bug in the IPv6 RPL Source Routing Header decompressor, and RPL is the routing protocol used by many low-power IoT mesh networks over 6LoWPAN. Any device that processes RPL packets and has CONFIG_IPV6 with RPL enabled is exposed over the network. Related low-power networking fixes include CVE-2026-64452 (a use-after-free in the 6LoWPAN header-compression error path) and CVE-2026-63870 (accept only IPv6 packets in the 802.15.4 6LoWPAN transmit path).
Devices that run in USB device mode should apply CVE-2026-64505 (a missing RNDIS header length check) and CVE-2026-63896 (an integer underflow in WebUSB URL handling), both gated by CONFIG_USB_GADGET. SoC debug builds with CONFIG_CORESIGHT should include CVE-2026-64402, an out-of-bounds write in the UltraSoC trace buffer driver. Many sensor drivers (the iio subsystem), plus i2c, spi and gpio drivers, received fixes as well, so the exact list depends on your board’s configuration. Note that products frozen on 5.10 or 5.15 are affected this week and should plan an update to 5.10.261 or 5.15.212.
Cloud and datacenter
On shared, multi-tenant hosts the KVM guest-to-host bugs are the priority. CVE-2026-63938 (CVSS 9.3) lets a malicious AMD SEV guest drive Page State Change indices past the scratch buffer, which gives a path to read and corrupt host memory. CVE-2026-63794 is a page overflow in the SEV debug-crypt path, CVE-2026-64285 fixes a read-only pin when adding SNP CPUID data, and CVE-2026-64283 fixes a signed-overflow bypass in guest_memfd memslot binding. These need CONFIG_KVM and, for the SEV items, CONFIG_KVM_AMD_SEV. Update confidential-compute and multi-tenant virtualization hosts first.
Storage targets that export NVMe over Fabrics should apply CVE-2026-64320, a pre-authentication out-of-bounds heap read in the NVMe target Discovery Get Log Page handler (CONFIG_NVME_TARGET). For local container-escape surface, apply CVE-2026-64109 (an af_unix use-after-free, CVSS 8.8), CVE-2026-64006 (netfilter nf_tables register corruption), CVE-2026-64426 (an io_uring file-reference leak), CVE-2026-64354 (a bpf BTF overflow), and CVE-2026-64300 (a perf ring-buffer use-after-free). The network criticals CVE-2026-64024 (TCP, CVSS 9.4) and CVE-2026-63984 (IPv6 RPL, CVSS 9.8) apply to every host. Hosts that serve SMB should apply the ksmbd fixes CVE-2026-64437 and CVE-2026-64400. One planning item stands out this week: hosts still on 7.0 must migrate to 7.1.5, because 7.0 is now end of life and did not receive this batch.
Medical devices
Several fixes are relevant to connected medical devices. The Bluetooth bugs CVE-2026-63947 (CVSS 8.8), CVE-2026-64434 and CVE-2026-64403 matter for wearables, patient monitors, and hearing devices that use Bluetooth. The Wi‑Fi bugs CVE-2026-64515 and CVE-2026-64030 matter for clinical devices on wireless networks. The network-stack criticals CVE-2026-63984 (IPv6 RPL) and CVE-2026-64024 (TCP), along with CVE-2026-64518 (a TCP-AO out-of-bounds access), matter for networked clinical devices that use DICOM or HL7 and FHIR over IP. Devices with bedside USB peripherals should include CVE-2026-64505 and CVE-2026-63896.
Medical-device patching is gated by validation and regulatory revalidation, under US FDA postmarket cybersecurity guidance, the EU Medical Device Regulation (MDR), and IEC 62304, so the action is to plan the stable kernel update through the manufacturer’s change-control process rather than to apply it ad hoc. Because several of these are network-reachable and high severity, they are strong candidates to move up the change-control queue.
How to check which Linux kernel CVEs apply to you
There are three questions.
First, version. Compare uname -r with the table above and update to the current release for your branch. This week every active branch is affected, including 5.10 and 5.15. If you are on 7.0, plan a move to 7.1.5, because 7.0 is end of life.
Second, configuration. Check your kernel config for the feature behind each CVE, for example zcat /proc/config.gz | grep CONFIG_IPV6, or CONFIG_BT, CONFIG_MAC80211, CONFIG_KVM_AMD_SEV, CONFIG_NVME_TARGET, CONFIG_SMB_SERVER, or CONFIG_USB_GADGET. If a feature is not built, the matching CVE cannot affect you. With 763 fixes in one batch, this step is the fastest way to cut the list down to what your device actually runs.
Third, reachability, which sets the order of work. Network-reachable bugs come first this week, because there are real ones: CVE-2026-63984 (IPv6 RPL, CVSS 9.8) and CVE-2026-64024 (TCP, CVSS 9.4) need no privilege and no user action, and the Bluetooth and Wi‑Fi bugs are reachable over the air from an adjacent device. Local unprivileged memory corruption comes next, such as the af_unix, netfilter, bpf, io_uring and perf bugs. Guest-to-host bugs come after that on shared virtualization hosts, led by the KVM SEV set. Configuration-gated and single-driver bugs come last, and only if the feature is built.
Key takeaways
- Update to the current release for your branch: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or mainline 7.2-rc4. It carries the whole batch.
- The 7.0 series is end of life. Move 7.0 systems to 7.1.5; there is no 7.0 update for this batch.
- Every active branch is affected this week, including the old 5.10 and 5.15 LTS branches. There is no exempt branch.
- Schedule the network-reachable criticals first:
CVE-2026-63984(IPv6 RPL),CVE-2026-64024(TCP), and the Bluetooth and Wi‑Fi bugs. - On virtualization hosts, apply the KVM SEV guest-to-host fixes (
CVE-2026-63938first). On storage targets, applyCVE-2026-64320(NVMe-oF). - Use your kernel config to cut the 763 down to what your device runs. None of these are 0-days; all fixes are already in stable. Test the update on your own hardware.
Frequently asked questions
What is the one thing I should do?
Update to the current release for your branch, which carries the whole batch. Then use your kernel config and device type to decide what to test first.
763 CVEs in one week. Is that real?
Yes. The kernel CVE project published them in one large batch, and the count is confirmed by both the lore.kernel.org archive and the NVD, which each report 763 for this window. Most are narrow driver and filesystem fixes.
I am on 7.0. What do I do?
Move to 7.1.5. The 7.0 series reached end of life (its last release was 7.0.14 on 27 June 2026) and did not receive this batch, so updating within 7.0 is not possible.
I am on 5.10 or 5.15. Am I affected this week?
Yes. Unlike some recent weeks, several bugs reach back to the 5.10 and 5.15 branches, so plan an update to 5.10.261 or 5.15.212.
Which ones are network-reachable?
The most serious are CVE-2026-63984 (IPv6 RPL, CVSS 9.8) and CVE-2026-64024 (TCP sequence prediction, CVSS 9.4), both reachable over the network with no privilege. The Bluetooth (CVE-2026-63947) and Wi‑Fi (CVE-2026-64030) bugs are reachable over the air from an adjacent device.
