The Linux kernel project published 33 Linux kernel CVEs in the week of 26 July to 1 August 2026. This is a normal-volume week after last week’s large batch. Every CVE is already fixed in a stable release, and there is no 0-day and no public exploit code. The action is to update your kernel to the newest release for your branch. Three are network-reachable and should be scheduled first: CVE-2026-64535 (NVMe/TCP target, CVSS 9.8), CVE-2026-64541 (SMC sockets, CVSS 9.8), and CVE-2026-64551 (SCTP, CVSS 9.1). The newest safe release per branch is 5.10.262, 5.15.213, 6.1.180, 6.6.147, 6.12.100, 6.18.41, 7.1.5, or mainline 7.2-rc5. The 7.0 series stays end of life; move 7.0 systems to 7.1.5.
Last week was a 763-CVE batch. This week is back to a normal size, with 33 CVEs. Most are narrow driver and networking fixes, and which of them matter for you depends on what your product runs and how it is configured. Three stand out because they are reachable over the network with no privilege, so treat them as the priority everywhere they apply. This advisory gives the version to install first. It then explains which Linux kernel CVEs matter for mobile and automotive, embedded and IoT, cloud and datacenter, and medical devices.
The one action: update to the newest release for your branch
Run uname -r to see your current kernel version. Compare it with the target for your branch in the table below, then update to that release. Updating to the current release for your branch clears this week’s set.
| Stable branch | Update to at least | Notes |
|---|---|---|
| 5.10 LTS | 5.10.262 | Affected (for example CVE-2026-64541, CVE-2026-64551, CVE-2026-64540). |
| 5.15 LTS | 5.15.213 | Affected, same as 5.10. |
| 6.1 LTS | 6.1.180 | Current release; carries this week’s 6.1 backports. |
| 6.6 LTS | 6.6.147 | Current release. |
| 6.12 LTS | 6.12.100 | Current release. Also gets the KVM arm64 fix CVE-2026-64555 (6.7+ only). |
| 6.18 LTS | 6.18.41 | Current release. |
| 7.1 stable | 7.1.5 | Current stable release. |
| mainline | 7.2-rc5 | All merged. |
| 7.0 | end of life — move to 7.1.5 | 7.0 is retired and is no longer listed on kernel.org. Migrate to 7.1. |
Every active branch is affected this week. A few fixes are branch-limited: CVE-2026-64555 (KVM arm64 nested virtualization) affects 6.7 and later only, and CVE-2026-64542 (an IPv6 neighbor-discovery null-pointer dereference) affects 6.0 and later. Installing the current release for your branch is the reliable way to pick up whichever apply.
Mobile and automotive
The Bluetooth fixes are the first thing to review for phones and car head units. CVE-2026-64557 (CVSS 8.8, reachable from an adjacent device) is a use-after-free in the L2CAP socket path where a child socket is freed before a callback dereferences it. CVE-2026-64539 (CVSS 7.8) is a stack out-of-bounds write when the kernel prepends the Flags advertising field to instance advertising data, and CVE-2026-64549 is an out-of-bounds read in the bpa10x driver. All need CONFIG_BT. On Wi‑Fi, CVE-2026-64536 (CVSS 8.1) is an out-of-bounds read in the staging rtl8723bs driver when it walks information elements from a nearby transmitter.
Devices that use USB-Ethernet or USB tethering should apply CVE-2026-64540 and CVE-2026-64547 (both CVSS 8.1), out-of-bounds reads triggered by a malicious USB-network device. Head units that parse a display’s EDID should include CVE-2026-64546 (CVSS 7.1), an out-of-bounds read of a crafted tiled-display block. Modem-based platforms should include CVE-2026-64550, a length-validation fix in the Qualcomm rmnet path. The three network criticals below apply to any connected device.
Embedded and IoT
The USB-network out-of-bounds reads CVE-2026-64540 (gl620a) and CVE-2026-64547 (net1080) matter for gateways and IoT devices that use USB-Ethernet adapters, because a malicious or faulty USB device can trigger them. CVE-2026-64543 (CVSS 7.8) is a use-after-free in the TIPC discoverer; TIPC is used for cluster and machine-to-machine messaging in some telecom and industrial systems, so apply it if CONFIG_TIPC is set. Devices that mount NTFS media should include the ntfs3 validation fixes CVE-2026-64532 and CVE-2026-64533. Embedded hypervisor builds that use virtio networking should apply CVE-2026-64552 (CVSS 8.4), where a malicious backend can drive an out-of-bounds write in the guest. Products on 5.10 or 5.15 are affected this week and should plan an update to 5.10.262 or 5.15.213.
Cloud and datacenter
Three network-reachable criticals lead here. CVE-2026-64535 (CVSS 9.8) is a use-after-free on an NVMe/TCP storage target that a remote initiator can trigger with a data-digest mismatch; apply it on any host that exports NVMe over Fabrics (CONFIG_NVME_TARGET_TCP). CVE-2026-64541 (CVSS 9.8) is a use-after-free in the SMC socket receive path, reachable on SMC-R (RDMA) links used in datacenters and on mainframes (CONFIG_SMC). CVE-2026-64551 (CVSS 9.1) lets a remote SCTP peer read back uninitialized kernel memory (CONFIG_IP_SCTP). On virtualization hosts, CVE-2026-64555 (CVSS 8.8) is a guest-to-host bug in KVM arm64 nested virtualization, and CVE-2026-64552 affects guests that use virtio networking.
Also relevant on shared hosts: CVE-2026-64560 (a posix-cpu-timers use-after-free, CVSS 7.8), CVE-2026-64556 (a perf event-group teardown fix), CVE-2026-64531 (an Open vSwitch attribute-size check), and CVE-2026-64553 (a psample information leak). Hosts still on 7.0 must move to 7.1.5, because 7.0 is end of life.
Medical devices
The Bluetooth bugs CVE-2026-64557 (CVSS 8.8) and CVE-2026-64539 matter for wearables, patient monitors, and hearing devices that use Bluetooth. The Wi‑Fi bug CVE-2026-64536 matters for clinical devices on wireless networks. The network-stack criticals CVE-2026-64551 (SCTP), CVE-2026-64543 (TIPC), and the IPv6 fixes CVE-2026-64542 and CVE-2026-64538 matter for networked clinical devices that use DICOM or HL7 and FHIR over IP; SCTP in particular carries signaling in some clinical and telecom stacks. Devices with bedside USB-Ethernet adapters should include CVE-2026-64540 and CVE-2026-64547.
Medical-device patching is gated by validation and regulatory revalidation, under US FDA postmarket cybersecurity guidance, the EU Medical Device Regulation (MDR), and IEC 62304, so the action is to plan the stable kernel update through the manufacturer’s change-control process rather than to apply it ad hoc. The three network-reachable criticals are strong candidates to move up the change-control queue.
How to check which Linux kernel CVEs apply to you
There are three questions.
First, version. Compare uname -r with the table above and update to the current release for your branch. This week every active branch is affected, including 5.10 and 5.15. If you are on 7.0, move to 7.1.5, because 7.0 is end of life.
Second, configuration. Check your kernel config for the feature behind each CVE, for example zcat /proc/config.gz | grep CONFIG_NVME_TARGET_TCP, or CONFIG_SMC, CONFIG_IP_SCTP, CONFIG_BT, CONFIG_VIRTIO_NET, or the CONFIG_USB_NET_* options. If a feature is not built, the matching CVE cannot affect you.
Third, reachability, which sets the order of work. The network-reachable criticals come first: CVE-2026-64535 (NVMe/TCP), CVE-2026-64541 (SMC), and CVE-2026-64551 (SCTP) need no privilege. Adjacent bugs come next: the Bluetooth and Wi‑Fi bugs are reachable over the air, and the USB-network bugs need a malicious USB device attached. Guest-to-host bugs come after that on shared virtualization hosts, led by CVE-2026-64555. Local bugs such as the posix-cpu-timers use-after-free come last.
Key takeaways
- Update to the current release for your branch: 5.10.262, 5.15.213, 6.1.180, 6.6.147, 6.12.100, 6.18.41, 7.1.5, or mainline 7.2-rc5.
- Schedule the three network-reachable criticals first:
CVE-2026-64535(NVMe/TCP),CVE-2026-64541(SMC), andCVE-2026-64551(SCTP). - The 7.0 series is end of life. Move 7.0 systems to 7.1.5.
- Every active branch is affected this week, including the old 5.10 and 5.15 LTS branches.
- Adjacent-access bugs still need action: Bluetooth (
CVE-2026-64557), Wi‑Fi (CVE-2026-64536), and USB-network (CVE-2026-64540,CVE-2026-64547). - None of these are 0-days; all fixes are already in stable. Use your kernel config to cut the list, and test the update on your own hardware.
Frequently asked questions
What is the one thing I should do?
Update to the current release for your branch. Then use your kernel config and device type to decide what to test first.
Which ones are most urgent?
The three network-reachable criticals: CVE-2026-64535 (NVMe/TCP target, CVSS 9.8), CVE-2026-64541 (SMC sockets, CVSS 9.8), and CVE-2026-64551 (SCTP, CVSS 9.1). All are reachable over the network with no privilege.
I am on 7.0. What do I do?
Move to 7.1.5. The 7.0 series is end of life and is no longer listed on kernel.org, so there is no 7.0 update.
We do not run NVMe over Fabrics, SMC or SCTP. Do the criticals affect us?
No. Each of the three criticals is gated by a config option (CONFIG_NVME_TARGET_TCP, CONFIG_SMC, CONFIG_IP_SCTP). If those are not built, the criticals cannot affect you, but the Bluetooth, Wi‑Fi and USB-network bugs may still apply.
Are the USB-network bugs remote?
No. CVE-2026-64540 and CVE-2026-64547 need a malicious or faulty USB-Ethernet device to be attached, so they matter where untrusted USB devices can be plugged in.
