What is CVE-2026-64147?

CVE-2026-64147 is a medium-severity vulnerability in Linux, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 5.5/10. Published 2026-07-19.

How severe is CVE-2026-64147?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Vulnerability in Linux

CVE-2026-64147

In the Linux kernel, the following vulnerability has been resolved: pds_core: fix debugfs_lookup dentry leak and error handling debugfs_lookup() returns a dentry with an elevated reference count that must be released with dput(). The current code discards the returned dentry without calling dput(), causing a reference leak on every firmware reset recovery. Additionally, when CONFIG_DEBUG_FS is disabled, debugfs_lookup() returns ERR_PTR(-ENODEV), not NULL. The current check passes for error pointers and would call dput() on an invalid pointer, causing a crash.

EPSS: 0.001 (2.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Linux — versions 2bbf2b1c20f934a054172175ccbabcc01fe69ef6, bc90fbe0c3182157d2be100a2f6c2edbb1820677, 3ffe14c36985e3174933127c9efad82ac8f3fefb
Linux Linux_kernel — versions 6.8, 7.1

Weakness classification (CWE)

CWE-401 — Missing Release of Memory after Effective Lifetime

References

416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)

Frequently asked questions

What is CVE-2026-64147?: CVE-2026-64147 is a medium-severity vulnerability in Linux, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 5.5/10. Published 2026-07-19.
How severe is CVE-2026-64147?: Medium severity. CVSS v3 base score is 5.5 out of 10.