The Linux kernel project published 46 Linux kernel CVEs in the week of 2 to 8 August 2026. Every one is already fixed in a stable release. There is no 0-day and no public exploit code. The only action is to update your kernel to the fixed version for your branch. The minimum safe release per branch is 5.10.264, 5.15.215, 6.1.182, 6.6.150, 6.12.102, 6.18.43, 7.1.7, or mainline 7.2-rc5. The 6.19 and 7.0 series are end of life; move those systems to 7.1.7.
This is a normal-volume week, with 46 CVEs. Most are narrow driver and networking fixes. Which of these Linux kernel CVEs matter for you depends on what your product builds and how it is configured. No CVE this week has a public exploit or a CVSS score in the kernel record, so the order of work is set by how the bug is reached. A few are reachable over the air or over the network, so schedule those first where they apply. This advisory gives the version to install, then explains which CVEs matter for mobile and automotive, embedded and IoT, cloud and datacenter, and medical devices. Each CVE below has its own heading so you can link straight to it.
The one action: update to the fixed version for your branch
Run uname -r to see your current kernel version. Compare it with the target for your branch in the table below. If your version is lower than the target, update to the target release. Updating to the target release for your branch clears every CVE in this week’s set.
| Stable branch | Update to at least | Notes |
|---|---|---|
| 5.10 LTS | 5.10.264 | Affected; the SRSO fix CVE-2026-68480 sets this point release. |
| 5.15 LTS | 5.15.215 | Affected, same as 5.10. |
| 6.1 LTS | 6.1.182 | Current release; carries this week’s 6.1 backports. |
| 6.6 LTS | 6.6.150 | Current release. |
| 6.12 LTS | 6.12.102 | Current release. |
| 6.18 LTS | 6.18.43 | Current release. |
| 7.1 stable | 7.1.7 | Current stable release. |
| mainline | 7.2-rc5 | All fixes merged. |
Branches not listed were not affected this week, or their fix predates this window. The 6.19 and 7.0 series are end of life and receive no update; move those systems to 7.1.7.
Mobile and automotive
The wireless fixes matter most for phones and car head units. Each CVE that applies to this class has its own heading below.
CVE-2026-64573: Bluetooth QCA out-of-bounds write
A length underflow in the Qualcomm Bluetooth NVM TLV parser lets a 12-byte structure be written past a short firmware buffer. Qualcomm Bluetooth parts are common in phones and car head units, so this needs CONFIG_BT and CONFIG_BT_QCA. Fixed in 6.6.148, 6.12.101, 6.18.42, 7.1.6 and mainline 7.2-rc4. See the CVE record.
CVE-2026-64571: Wi-Fi p54 out-of-bounds read
A crafted EEPROM-readback frame reads past the socket buffer, so it is reachable over the air on devices that use a p54 USB or PCI adapter (CONFIG_P54_COMMON). Fixed in 6.6.148, 6.12.101, 6.18.42, 7.1.6 and mainline 7.2-rc4. See the CVE record.
CVE-2026-64586: Broadcom Wi-Fi use-after-free
The bus_reset work is not drained on device removal, so a pending callback can run after the driver data is freed. Broadcom FullMAC Wi-Fi is widely used in mobile platforms (CONFIG_BRCMFMAC). Fixed in 7.1.6 and mainline 7.2-rc5. See the CVE record.
CVE-2026-64568: mac80211 double free (unsolicited broadcast probe response)
The unsolicited broadcast probe response template is freed before a follow-up allocation that can fail, and teardown re-queues the same object. This needs CONFIG_MAC80211 and a software access point. Fixed in 6.12.101, 6.18.42, 7.1.6 and mainline 7.2-rc4. See the CVE record.
CVE-2026-64570: mac80211 double free (FILS discovery)
This is the same pattern as CVE-2026-64568 on the FILS discovery template (CONFIG_MAC80211). Fixed in 6.12.101, 6.18.42, 7.1.6 and mainline 7.2-rc4. See the CVE record.
CVE-2026-64574: mac80211 use-after-free (per-link debugfs)
On the vif-update error path the new per-link containers are freed but their debugfs entries remain, so a later read dereferences freed memory. This needs CONFIG_MAC80211 and a multi-link setup. Fixed in 6.6.148, 6.12.101, 6.18.42, 7.1.6 and mainline 7.2-rc5. See the CVE record.
CVE-2026-64577: GTP-U buffer under-run panic
gtp1u_send_echo_resp() ignores the skb_pull_data() return, so a short GTP-U echo request drives the buffer pointer below the buffer head and trips a panic (CONFIG_GTP). This matters for connected-car and mobile-core network stacks. Fixed in 6.6.148, 6.12.101, 6.18.42, 7.1.6 and mainline 7.2-rc5. See the CVE record.
CVE-2026-64564: SCTP use-after-free
DEL-IP ASCONF processing can free the ASCONF’s own transport, leaving a dangling pointer that a later DEL-IP reuses (CONFIG_IP_SCTP). It is reachable from an SCTP peer. Fixed in 6.6.148, 6.12.101, 6.18.42, 7.1.6 and mainline 7.2-rc5. See the CVE record.
Embedded and IoT
Broadcom Wi-Fi (CVE-2026-64586 above) also applies to many single-board computers. The CVEs specific to this class follow.
CVE-2026-64578: ksmbd out-of-bounds read
The in-kernel SMB server reads StructureSize2 of a compound element without a size check, so a crafted request reads past the receive buffer (CONFIG_SMB_SERVER). It is reachable by an SMB client against a ksmbd server on a gateway or network-attached storage device. Fixed in 6.6.148, 6.12.101, 6.18.42, 7.1.6 and mainline 7.2-rc4. See the CVE record.
CVE-2026-64565: Input ims-pcu heap buffer overflow
ims_pcu_process_data() does not bound read_pos, so a malicious USB device overflows the read buffer and controls the index (CONFIG_INPUT_IMS_PCU). It needs USB access and matters for kiosks and panels. Fixed in 6.6.148, 6.12.101, 6.18.42 and mainline 7.1. See the CVE record.
CVE-2026-64585: can esd_usb use-after-free
Disconnect frees each CAN network device before it kills the anchored URBs, so URB teardown dereferences freed data (CONFIG_CAN_ESD_USB). It is triggered by removing a USB-CAN adapter on an industrial gateway. Fixed in 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5 and mainline 7.2-rc4. See the CVE record.
CVE-2026-64567: btrfs out-of-bounds read
The version 1 free-space-cache load trusts the on-disk entry count, so a crafted image runs the index off the array (CONFIG_BTRFS_FS). It is reachable by mounting removable btrfs media. Fixed in 6.6.148, 6.12.101, 6.18.42, 7.1.6 and mainline 7.2-rc4. See the CVE record.
Cloud and datacenter
The KVM guest-to-host bugs are the highest priority here, followed by the storage and multi-tenant fixes.
CVE-2026-64562: KVM nVMX use-after-free
A shadow VMCS is freed while vmcs01 still points to it, and a vCPU migration can race a VMCLEAR on the freed page. This is a guest-to-host bug on hosts that run nested virtualization on Intel parts (CONFIG_KVM_INTEL with nested mode on). Fixed in 6.6.148, 6.12.101, 6.18.42, 7.1.6 and mainline 7.2-rc5. See the CVE record.
CVE-2026-64561: KVM x86 shadow-MMU invalid root
Reclaiming shadow pages can zap an in-use root, so pages get mapped into an invalid root and child pages inherit the invalid role. Guest activity triggers it (CONFIG_KVM). Fixed in 6.6.148, 6.12.101, 6.18.42, 7.1.6 and mainline 7.2-rc5. See the CVE record.
CVE-2026-68081: KVM nVMX page leak
A nested VM-Enter that fails on invalid guest state does not put the vmcs12 pages, leaking pinned host pages if the guest retries (CONFIG_KVM_INTEL with nested mode on). Fixed in 6.18.40, 7.1.5 and mainline 7.2-rc4. See the CVE record.
CVE-2026-64582: RDMA/rxe use-after-free
rxe_mmap() drops its lock and walks page tables while the object reference count is still one, and a concurrent destroy-completion-queue call frees the object mid-walk (CONFIG_RDMA_RXE, soft-RoCE). Fixed in 6.6.145, 6.12.97, 6.18.40, 7.1.5 and mainline 7.2-rc1. See the CVE record.
CVE-2026-68082: libceph out-of-bounds read
decode_lockers() has two unchecked decodes, so a malicious or compromised OSD can trigger slab out-of-bounds reads (CONFIG_CEPH_LIB). Fixed in 7.1.6 and mainline 7.2-rc5. See the CVE record.
CVE-2026-64597: SMB client double free
The SMB2 close replay path frees a response buffer that was already freed. It is reachable from a malicious or buggy SMB server (CONFIG_CIFS). Fixed in 6.6.145, 6.12.96, 6.18.39, 7.1.4 and mainline 7.2-rc1. See the CVE record.
CVE-2026-64598: SMB client invalid error pointer
smb2_aead_req_alloc() builds an invalid error pointer that crashes when it is dereferenced (CONFIG_CIFS). Fixed in 6.6.145, 6.12.96, 6.18.39, 7.1.4 and mainline 7.2-rc1. See the CVE record.
CVE-2026-64581: xfrm double free
xfrm_user_policy() clears the socket dst cache without atomics and races the connected-UDP transmit path, so the same dst is released twice. It is reachable by an unprivileged user through user and network namespaces (CONFIG_XFRM_USER) and matters on multi-tenant hosts. Fixed in 7.1.6 and mainline 7.2-rc4. See the CVE record.
CVE-2026-68480: x86 SRSO Safe-RET
On SRSO-affected CPUs, injecting interrupts while the Safe-RET mitigation runs can neutralize the safe return sequence and allow a speculative data leak (CONFIG_MITIGATION_SRSO). It matters where tenants share an affected AMD CPU. Fixed in 5.10.264, 5.15.215, 6.1.182, 6.6.150, 6.12.102, 6.18.43 and 7.1.7. See the CVE record.
Medical devices
The wireless and USB bugs above are the ones to review for connected clinical devices. The Bluetooth bug CVE-2026-64573 matters for wearables, patient monitors, and hearing devices that use Bluetooth. The Wi-Fi bugs CVE-2026-64571 (p54) and CVE-2026-64586 (Broadcom) matter for clinical devices on wireless networks. CVE-2026-64565 matters for bedside units with USB input peripherals. For networked clinical devices that carry DICOM or HL7 and FHIR over IP, CVE-2026-64564 in SCTP is relevant, because SCTP carries signaling in some clinical and telecom stacks; devices that expose an SMB share should also apply CVE-2026-64578. Medical-device patching is gated by validation and regulatory revalidation, under US FDA postmarket cybersecurity guidance, the EU Medical Device Regulation (MDR), and IEC 62304, so the action is to plan the stable kernel update through the manufacturer’s change-control process rather than to apply it ad hoc.
How to check which Linux kernel CVEs apply to you
There are three questions.
First, version. Run uname -r and compare it with the table above. If your release is below the target for your branch, update to the target. This clears every CVE in this week’s set for your branch.
Second, configuration. Check your kernel config for the feature behind each CVE. For example, run zcat /proc/config.gz | grep CONFIG_BT, or check CONFIG_MAC80211, CONFIG_P54_COMMON, CONFIG_SMB_SERVER, CONFIG_IP_SCTP, CONFIG_KVM_INTEL, or CONFIG_BRCMFMAC. If the feature is not built, the matching CVE cannot affect you.
Third, reachability, which sets the order of work. Over-the-air and network-reachable bugs come first: the Wi-Fi bug CVE-2026-64571, the Bluetooth bug CVE-2026-64573, and the network bugs CVE-2026-64564 (SCTP), CVE-2026-64577 (GTP-U) and CVE-2026-64578 (ksmbd). Local unprivileged bugs come next, such as the xfrm double free CVE-2026-64581. Guest-to-host bugs come after that on shared virtualization hosts, led by CVE-2026-64562. Bugs that need privilege or a specific configuration come last.
Key takeaways
- Update to the target release for your branch: 5.10.264, 5.15.215, 6.1.182, 6.6.150, 6.12.102, 6.18.43, 7.1.7, or mainline 7.2-rc5.
- Schedule the over-the-air and network-reachable bugs first:
CVE-2026-64571(Wi-Fi),CVE-2026-64573(Bluetooth),CVE-2026-64564(SCTP),CVE-2026-64577(GTP-U), andCVE-2026-64578(ksmbd). - On virtualization hosts, apply the KVM guest-to-host bugs
CVE-2026-64562,CVE-2026-64561, andCVE-2026-68081. - The 6.19 and 7.0 series are end of life; move those systems to 7.1.7.
- The SRSO fix
CVE-2026-68480sets the newest required point release on every LTS branch, including 5.10 and 5.15. - None of these are 0-days; all fixes are already in stable. Use your kernel config to remove the CVEs that do not apply, and test the update on your own hardware.
Frequently asked questions
What is the one thing I should do?
Update to the target release for your branch. Then use your kernel config and device type to decide what to test first.
Which ones should I schedule first?
The over-the-air and network-reachable bugs: CVE-2026-64571 (Wi-Fi p54), CVE-2026-64573 (Bluetooth QCA), CVE-2026-64564 (SCTP), CVE-2026-64577 (GTP-U), and CVE-2026-64578 (ksmbd SMB server). None has public exploit code.
Are any of these a 0-day?
No. All 46 CVEs are already fixed in stable, and there is no public exploit code. The action is to schedule the stable update through your normal process.
I run virtualization hosts. Which CVEs apply?
The KVM guest-to-host bugs CVE-2026-64562, CVE-2026-64561, and CVE-2026-68081. They apply to hosts running nested virtualization on Intel parts, so they need CONFIG_KVM_INTEL with nested mode on.
We do not build Wi-Fi, Bluetooth or the SMB server. Do these affect us?
Each bug is gated by a kernel config option. If CONFIG_MAC80211, CONFIG_P54_COMMON, CONFIG_BT and CONFIG_SMB_SERVER are not built, those bugs cannot affect you. Check your config to remove the ones that do not apply.
