CVE-2026-64035
Linux Kernel 6.16 – 6.18.34
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-64035 is a critical-severity Missing Initialization of Resource (CWE-909) vulnerability in Linux Linux Kernel. Its CVSS base score is 9.8 (Critical).
Operationally, ranked at the 37th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-45608
Vulnerability Data
In the Linux kernel, the following vulnerability has been resolved: igc: set tx buffer type for SMD frames Sashiko pointed out that igc_fpe_init_smd_frame() initializes igc_tx_buffer fields for an SMD skb, but does not set the buffer type: https://sashiko.dev/#/patchset/20260415025226.114115-1-kohei%40enjuk.jp Since igc_tx_buffer…
more
entries are reused, a stale XDP or XSK type can remain and make TX completion use the wrong cleanup path. Set the buffer type to IGC_TX_BUFFER_TYPE_SKB.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development life cycle mandates initialization of resources before use.
A.8.26 only requires that security requirements (including initialization-related ones) be identified and specified during development or acquisition; it does not itself enforce, implement or assure initialization of resources and therefore does not stop exploitation of an uninitialized resource that still reaches production.
Secure architecture principles include proper resource lifecycle management.
Secure coding standards explicitly require initialization of variables and resources.
Security testing can detect missing initialization defects before deployment.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-909, a class-level weakness, and none of its children carries one either.