46 Linux kernel flaws in one week — your branch has the fix, your kernel probably doesn't
The Linux project published 46 CVEs between August 2 and 8, 2026. Every single one is already fixed in stable, none are 0-days, but the gap between the available patch and the kernel running on your machines is the real risk.
August 2, 2026. August 8, 2026. 46 CVEs. In seven days, the Linux kernel project published 46 security advisories spanning every stable branch from 5.10 LTS to 7.2-rc5 mainline. Zero 0-days. Zero public exploits. Every flaw already patched — yet most production kernels haven’t received those patches yet.
The week of August 2-8, 2026 is a clean snapshot of what kernel security has become: high-volume, low-noise patching, where the only operational decision that matters is how fast you ship your branch’s point release.
One action: bump your kernel
Run uname -r, compare it against your branch target, upgrade if you’re below it. Every fix from this week is bundled in the point release listed.
| Stable branch | Upgrade to at least | Note |
|---|---|---|
| 5.10 LTS | 5.10.264 | Affected; the SRSO fix CVE-2026-68480 sets this point release. |
| 5.15 LTS | 5.15.215 | Affected, same as 5.10. |
| 6.1 LTS | 6.1.182 | This week’s backports included. |
| 6.6 LTS | 6.6.150 | Current release. |
| 6.12 LTS | 6.12.102 | Current release. |
| 6.18 LTS | 6.18.43 | Current release. |
| 7.1 stable | 7.1.7 | Current stable release. |
| mainline | 7.2-rc5 | All fixes merged. |
The 6.19 and 7.0 series are end-of-life. Move those systems to 7.1.7 immediately.
Network-reachable bugs: schedule these first
Not all CVEs are equal. Five flaws are reachable over the air or over the network with no prior authentication — these go to the top of your patching queue.
CVE-2026-64571 — out-of-bounds read in the p54 Wi‑Fi driver. A crafted frame during EEPROM readback reads past the socket buffer. Reachable over the air on any device using a p54 USB or PCI adapter (CONFIG_P54_COMMON).
CVE-2026-64573 — out-of-bounds write in the Qualcomm Bluetooth NVM parser. A length underflow writes a 12-byte structure past a short firmware buffer. Qualcomm BT chips power the majority of smartphones and automotive head units (CONFIG_BT, CONFIG_BT_QCA).
CVE-2026-64564 — use-after-free in SCTP (CONFIG_IP_SCTP). Network-reachable; SCTP carries signaling in some telecom and clinical stacks (DICOM/HL7).
CVE-2026-64577 — buffer under-run panic in the GTP-U echo path (CONFIG_GTP). Network-reachable, affects mobile core network gateways.
CVE-2026-64578 — out-of-bounds read in the kernel SMB server (ksmbd). An SMB client triggers the bug with a crafted compound request (CONFIG_SMB_SERVER). Any NAS or gateway exposing a kernel SMB share is affected.
Virtualization hosts: three guest-to-host bugs
Cloud providers and private datacenters must prioritize this week’s three KVM flaws. They affect hosts running nested virtualization on Intel CPUs (CONFIG_KVM_INTEL with nested mode enabled).
CVE-2026-64562 — use-after-free where a shadow VMCS is freed while still referenced and a vCPU migration races a VMCLEAR.
CVE-2026-64561 — guest activity maps pages into an invalid shadow-MMU root.
CVE-2026-68081 — pinned host pages leak when a nested VM-Enter fails.
None of these three bugs requires guest privileges. A malicious tenant on a shared host can potentially read another guest’s memory or cause denial of service. On multi-tenant hosts, schedule these ahead of everything except the network-reachable bugs.
Kernel config: your best CVE filter
Every CVE this week is gated by a kernel configuration option. If CONFIG_MAC80211, CONFIG_P54_COMMON, CONFIG_BT, CONFIG_SMB_SERVER, or CONFIG_IP_SCTP are not compiled, the corresponding bugs cannot affect you.
# Check exposed features in one command
zcat /proc/config.gz | grep -E 'CONFIG_(BT|MAC80211|P54_COMMON|SMB_SERVER|IP_SCTP|KVM_INTEL|BRCMFMAC)'This gives you your real CVE list in five seconds. On a minimal headless server, none of the Wi‑Fi or Bluetooth flaws apply — you go from 46 CVEs to roughly a dozen.
Medical, embedded, automotive: each sector gets a subset
Mobile and automotive. CVE-2026-64586 (Broadcom FullMAC Wi‑Fi use-after-free) and CVE-2026-64573 (Qualcomm Bluetooth) are the most likely hits on these platforms. The mac80211 bugs CVE-2026-64568 and CVE-2026-64570 affect software access points and multi-link setups.
Embedded and IoT. CVE-2026-64567 (out-of-bounds read in btrfs free-space cache) affects devices mounting removable btrfs media. CVE-2026-64565 is a heap buffer overflow in the IMS PCU driver, triggered by a malicious USB device.
Medical devices. Connected clinical devices using Bluetooth need the CVE-2026-64573 fix. Bedside units with USB peripherals are affected by CVE-2026-64565. The SCTP fix CVE-2026-64564 applies to devices carrying DICOM or HL7/FHIR over IP. Important: medical device patching is governed by the FDA postmarket cybersecurity guidance (US), the EU MDR, and IEC 62304 — plan the stable kernel update through the manufacturer’s change-control process, not ad hoc.
Verdict
If you run cloud or datacenter servers, prioritize the three KVM bugs (CVE-2026-64562, CVE-2026-64561, CVE-2026-68081) and the xfrm double-free CVE-2026-64581 (reachable by an unprivileged user via network namespaces). Ship your branch update to all hypervisors before the end of the week.
If you manage a mobile or automotive fleet, focus on the Wi‑Fi and Bluetooth fixes — CVE-2026-64571, CVE-2026-64573, CVE-2026-64586.
If you run servers exposing ksmbd or SCTP, CVE-2026-64578 and CVE-2026-64564 are your top priorities: reachable without authentication.
The good news: there are zero 0-days, zero public exploits, and every fix is already in a stable release. The risk isn’t in the code — it’s in the gap between when the fix ships and when it lands on your machines.