The Linux kernel project published 46 Linux kernel CVEs in the week of 2 to 8 August 2026. Every one is already fixed in a stable release. There is no 0-day and no public exploit code. The only action is to update your kernel to the fixed version for your branch. The minimum safe release per branch is 5.10.264, 5.15.215, 6.1.182, 6.6.150, 6.12.102, 6.18.43, 7.1.7, or mainline 7.2-rc5. The 6.19 and 7.0 series are end of life; move those systems to 7.1.7.
This is a normal-volume week, with 46 CVEs. Most are narrow driver and networking fixes. Which of these Linux kernel CVEs matter for you depends on what your product builds and how it is configured. No CVE this week has a public exploit or a CVSS score in the kernel record, so the order of work is set by how the bug is reached. A few are reachable over the air or over the network, so schedule those first where they apply. This advisory gives the version to install, then explains which CVEs matter for mobile and automotive, embedded and IoT, cloud and datacenter, and medical devices.
The one action: update to the fixed version for your branch
Run uname -r to see your current kernel version. Compare it with the target for your branch in the table below. If your version is lower than the target, update to the target release. Updating to the target release for your branch clears every CVE in this week's set.
| Stable branch | Update to at least | Notes |
|---|---|---|
| 5.10 LTS | 5.10.264 | Affected; the SRSO fix CVE-2026-68480 sets this point release. |
| 5.15 LTS | 5.15.215 | Affected, same as 5.10. |
| 6.1 LTS | 6.1.182 | Current release; carries this week's 6.1 backports. |
| 6.6 LTS | 6.6.150 | Current release. |
| 6.12 LTS | 6.12.102 | Current release. |
| 6.18 LTS | 6.18.43 | Current release. |
| 7.1 stable | 7.1.7 | Current stable release. |
| mainline | 7.2-rc5 | All fixes merged. |
Branches not listed were not affected this week, or their fix predates this window. The 6.19 and 7.0 series are end of life and receive no update; move those systems to 7.1.7.
Mobile and automotive
The wireless fixes matter most for phones and car head units. CVE-2026-64571 is an out-of-bounds read in the Wi-Fi p54 driver; a crafted frame during an EEPROM readback reads past the socket buffer, so it is reachable over the air on devices that use a p54 USB or PCI adapter (CONFIG_P54_COMMON). CVE-2026-64573 is an out-of-bounds write in the Qualcomm Bluetooth NVM parser; a length underflow lets a 12-byte structure be written past a short firmware buffer, and Qualcomm Bluetooth parts are common in phones and head units (CONFIG_BT, CONFIG_BT_QCA). CVE-2026-64586 is a use-after-free in the Broadcom FullMAC Wi-Fi driver when the device is removed, and Broadcom Wi-Fi is widely used in mobile platforms (CONFIG_BRCMFMAC). The mac80211 bugs CVE-2026-64568 and CVE-2026-64570 are double frees on the beacon and FILS discovery configuration path, and CVE-2026-64574 is a use-after-free reached through the per-link debugfs files; all three need CONFIG_MAC80211 and a software access point or multi-link setup. For connected-car network stacks, CVE-2026-64577 is a buffer under-run panic in the GTP-U echo path (CONFIG_GTP) and CVE-2026-64564 is a use-after-free in SCTP (CONFIG_IP_SCTP); both are reachable from the network.
Embedded and IoT
The Broadcom Wi-Fi use-after-free CVE-2026-64586 matters here too, because many single-board computers use Broadcom FullMAC parts (CONFIG_BRCMFMAC). Gateways and network-attached storage devices that run the in-kernel SMB server should apply CVE-2026-64578, an out-of-bounds read that an SMB client can trigger against a crafted compound request (CONFIG_SMB_SERVER). Panels and kiosks that use the IMS PCU device should apply CVE-2026-64565, a heap buffer overflow driven by a malicious USB device (CONFIG_INPUT_IMS_PCU); it needs USB access. Industrial gateways with USB-CAN adapters should apply CVE-2026-64585, a use-after-free when an esd USB-CAN device is removed (CONFIG_CAN_ESD_USB). Devices that mount removable btrfs media should apply CVE-2026-64567, an out-of-bounds read from a crafted free-space cache (CONFIG_BTRFS_FS). Products still on 5.10 or 5.15 are affected this week through the SRSO fix and shared driver fixes, so plan an update to 5.10.264 or 5.15.215.
Cloud and datacenter
The KVM guest-to-host bugs are the highest priority here. CVE-2026-64562 is a use-after-free where a shadow VMCS is freed while it is still referenced and a vCPU migration races a VMCLEAR. CVE-2026-64561 lets guest activity map pages into an invalid shadow-MMU root. CVE-2026-68081 leaks pinned host pages when a nested VM-Enter fails. All three apply to hosts that run nested virtualization on Intel parts (CONFIG_KVM_INTEL with nested mode on). CVE-2026-64582 is a use-after-free in the soft-RoCE driver (CONFIG_RDMA_RXE), and CVE-2026-68082 is an out-of-bounds read in the Ceph client that a malicious or compromised OSD can trigger (CONFIG_CEPH_LIB). File servers should apply the ksmbd bug CVE-2026-64578 (CONFIG_SMB_SERVER) and clients should apply CVE-2026-64597 and CVE-2026-64598 in the SMB client (CONFIG_CIFS). On multi-tenant hosts, CVE-2026-64581 is a double free in the xfrm policy path that an unprivileged user can reach through user and network namespaces (CONFIG_XFRM_USER), and CVE-2026-68480 is the SRSO speculation fix that matters where guests from different tenants share an affected AMD CPU (CONFIG_MITIGATION_SRSO).
Medical devices
The wireless and USB bugs are the ones to review for connected clinical devices. CVE-2026-64573 in the Qualcomm Bluetooth parser matters for wearables, patient monitors, and hearing devices that use Bluetooth (CONFIG_BT). The Wi-Fi bugs CVE-2026-64571 (p54) and CVE-2026-64586 (Broadcom) matter for clinical devices on wireless networks (CONFIG_P54_COMMON, CONFIG_BRCMFMAC). CVE-2026-64565 matters for bedside units with USB input peripherals (CONFIG_INPUT_IMS_PCU). For networked clinical devices that carry DICOM or HL7 and FHIR over IP, CVE-2026-64564 in SCTP is relevant, because SCTP carries signaling in some clinical and telecom stacks (CONFIG_IP_SCTP); devices that expose an SMB share should also apply CVE-2026-64578 (CONFIG_SMB_SERVER). Medical-device patching is gated by validation and regulatory revalidation, under US FDA postmarket cybersecurity guidance, the EU Medical Device Regulation (MDR), and IEC 62304, so the action is to plan the stable kernel update through the manufacturer's change-control process rather than to apply it ad hoc.
How to check which Linux kernel CVEs apply to you
There are three questions.
First, version. Run uname -r and compare it with the table above. If your release is below the target for your branch, update to the target. This clears every CVE in this week's set for your branch.
Second, configuration. Check your kernel config for the feature behind each CVE. For example, run zcat /proc/config.gz | grep CONFIG_BT, or check CONFIG_MAC80211, CONFIG_P54_COMMON, CONFIG_SMB_SERVER, CONFIG_IP_SCTP, CONFIG_KVM_INTEL, or CONFIG_BRCMFMAC. If the feature is not built, the matching CVE cannot affect you.
Third, reachability, which sets the order of work. Over-the-air and network-reachable bugs come first: the Wi-Fi bug CVE-2026-64571, the Bluetooth bug CVE-2026-64573, and the network bugs CVE-2026-64564 (SCTP), CVE-2026-64577 (GTP-U) and CVE-2026-64578 (ksmbd). Local unprivileged bugs come next, such as the xfrm double free CVE-2026-64581. Guest-to-host bugs come after that on shared virtualization hosts, led by CVE-2026-64562. Bugs that need privilege or a specific configuration come last.
Key takeaways
- Update to the target release for your branch: 5.10.264, 5.15.215, 6.1.182, 6.6.150, 6.12.102, 6.18.43, 7.1.7, or mainline 7.2-rc5.
- Schedule the over-the-air and network-reachable bugs first: CVE-2026-64571 (Wi-Fi), CVE-2026-64573 (Bluetooth), CVE-2026-64564 (SCTP), CVE-2026-64577 (GTP-U), and CVE-2026-64578 (ksmbd).
- On virtualization hosts, apply the KVM guest-to-host bugs CVE-2026-64562, CVE-2026-64561, and CVE-2026-68081.
- The 6.19 and 7.0 series are end of life; move those systems to 7.1.7.
- The SRSO fix CVE-2026-68480 sets the newest required point release on every LTS branch, including 5.10 and 5.15.
- None of these are 0-days; all fixes are already in stable. Use your kernel config to remove the CVEs that do not apply, and test the update on your own hardware.
Frequently asked questions
What is the one thing I should do?
Update to the target release for your branch. Then use your kernel config and device type to decide what to test first.
Which ones should I schedule first?
The over-the-air and network-reachable bugs: CVE-2026-64571 (Wi-Fi p54), CVE-2026-64573 (Bluetooth QCA), CVE-2026-64564 (SCTP), CVE-2026-64577 (GTP-U), and CVE-2026-64578 (ksmbd SMB server). None has public exploit code.
Are any of these a 0-day?
No. All 46 CVEs are already fixed in stable, and there is no public exploit code. The action is to schedule the stable update through your normal process.
I run virtualization hosts. Which CVEs apply?
The KVM guest-to-host bugs CVE-2026-64562, CVE-2026-64561, and CVE-2026-68081. They apply to hosts running nested virtualization on Intel parts, so they need CONFIG_KVM_INTEL with nested mode on.
We do not build Wi-Fi, Bluetooth or the SMB server. Do these affect us?
Each bug is gated by a kernel config option. If CONFIG_MAC80211, CONFIG_P54_COMMON, CONFIG_BT and CONFIG_SMB_SERVER are not built, those bugs cannot affect you. Check your config to remove the ones that do not apply.
Top comments (0)