DEV Community

Raghu Bharadwaj
Raghu Bharadwaj

Posted on • Originally published at techveda.live

Linux Kernel CVEs: What to Patch by Device (26 Jul – 1 Aug 2026)

#linux #kernel #security #devops

The Linux kernel project published 33 Linux kernel CVEs in the week of 26 July to 1 August 2026. Normal-volume week after last week's large batch. Every CVE is already fixed in a stable release, no 0-day and no public exploit code. Update your kernel to the newest release for your branch. Three are network-reachable: CVE-2026-64535 (NVMe/TCP target, CVSS 9.8), CVE-2026-64541 (SMC sockets, CVSS 9.8), CVE-2026-64551 (SCTP, CVSS 9.1). Newest safe release per branch: 5.10.262, 5.15.213, 6.1.180, 6.6.147, 6.12.100, 6.18.41, 7.1.5, or mainline 7.2-rc5. The 7.0 series stays end of life; move 7.0 systems to 7.1.5.

Most of the 33 are narrow driver and networking fixes; which ones matter depends on config and device class. Three are network-reachable with no privilege, so treat them as the priority everywhere they apply.

The one action: update to the newest release for your branch

Run uname -r, compare with the table, and install the current release for your branch (it clears this week's set).

Stable branch Update to at least Notes
5.10 LTS 5.10.262 Affected (CVE-2026-64541, 64551, 64540).
5.15 LTS 5.15.213 Affected.
6.1 LTS 6.1.180 Current release.
6.6 LTS 6.6.147 Current release.
6.12 LTS 6.12.100 Also gets KVM arm64 fix CVE-2026-64555 (6.7+ only).
6.18 LTS 6.18.41 Current release.
7.1 stable 7.1.5 Current stable (latest_stable).
mainline 7.2-rc5
7.0 end of life — move to 7.1.5 Retired; no longer listed on kernel.org.

Mobile and automotive

Bluetooth: CVE-2026-64557 (L2CAP UAF, CVSS 8.8, adjacent), CVE-2026-64539 (eir stack OOB write, 7.8), CVE-2026-64549 (bpa10x OOB read). CONFIG_BT. Wi-Fi: CVE-2026-64536 (rtl8723bs OOB read, 8.1). USB-Ethernet/tethering: CVE-2026-64540, CVE-2026-64547 (8.1). Display EDID: CVE-2026-64546 (7.1). Modem: CVE-2026-64550 (rmnet length check). Network criticals apply to any connected device.

Embedded and IoT

USB-network OOB reads CVE-2026-64540 (gl620a), CVE-2026-64547 (net1080) for gateways using USB-Ethernet. CVE-2026-64543 (TIPC UAF, 7.8) for cluster/M2M messaging (CONFIG_TIPC). ntfs3 fixes CVE-2026-64532/64533 for devices mounting NTFS media. CVE-2026-64552 (virtio-net OOB write, 8.4) for virtualized builds. 5.10/5.15 affected (5.10.262 / 5.15.213).

Cloud and datacenter

Network criticals: CVE-2026-64535 (nvmet-tcp UAF, 9.8, CONFIG_NVME_TARGET_TCP), CVE-2026-64541 (net/smc UAF, 9.8, SMC-R, CONFIG_SMC), CVE-2026-64551 (sctp info leak, 9.1, CONFIG_IP_SCTP). Guest-to-host: CVE-2026-64555 (KVM arm64 nv, 8.8), CVE-2026-64552 (virtio-net). Also CVE-2026-64560 (posix-cpu-timers UAF, 7.8), CVE-2026-64556 (perf), CVE-2026-64531 (openvswitch), CVE-2026-64553 (psample info leak). 7.0 hosts must move to 7.1.5.

Medical devices

Bluetooth (CVE-2026-64557, 64539) for wearables/monitors; Wi-Fi (64536) for connected clinical devices; net/TCP-IP (CVE-2026-64551 sctp, 64543 tipc, 64542/64538 ipv6) for DICOM/HL7/FHIR devices; USB-Ethernet (64540, 64547) for bedside adapters. Patching is gated by validation and regulatory revalidation (US FDA postmarket cybersecurity guidance, EU MDR, IEC 62304); plan the stable update through the manufacturer's change-control process. The three network criticals are candidates to move up the queue.

How to check which Linux kernel CVEs apply to you

  1. Version. uname -r vs the table. Every branch is affected this week, including 5.10/5.15. On 7.0, move to 7.1.5 (EOL).
  2. Configuration. zcat /proc/config.gz | grep CONFIG_NVME_TARGET_TCP (and CONFIG_SMC, CONFIG_IP_SCTP, CONFIG_BT, CONFIG_VIRTIO_NET, CONFIG_USB_NET_*). Not built = not affected.
  3. Reachability (order). Network-reachable first (CVE-2026-64535, 64541, 64551); then adjacent (Bluetooth/Wi-Fi over the air, USB-network needs a device attached); then guest-to-host (CVE-2026-64555); then local (posix-cpu-timers).

Key takeaways

  • Update to the current release for your branch: 5.10.262, 5.15.213, 6.1.180, 6.6.147, 6.12.100, 6.18.41, 7.1.5, or mainline 7.2-rc5.
  • Schedule the three network criticals first: CVE-2026-64535 (NVMe/TCP), CVE-2026-64541 (SMC), CVE-2026-64551 (SCTP).
  • 7.0 is end of life; move to 7.1.5.
  • Every active branch is affected, including 5.10/5.15.
  • Adjacent bugs still need action: Bluetooth (64557), Wi-Fi (64536), USB-network (64540, 64547).
  • No 0-days; all fixed in stable. Use kernel config to cut the list; test on your hardware.

Further reading

Originally published at techveda.live.

Top comments (0)