Is CVE-2026-6386 actively exploited?

No active exploitation of CVE-2026-6386 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-6386 be exploited remotely?

No. CVE-2026-6386 requires local access to exploit.

What is the CVSS score of CVE-2026-6386?

CVE-2026-6386 has a CVSS score of 6.2 (MEDIUM).

HOME VULNERABILITIESCVE-2026-6386

MEDIUM

CVE-2026-6386

CWE-269Published: April 22, 2026· Updated: Apr 22, 2026

6.2

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:2.1th

Official Description

In order to apply a particular protection key to an address range, the kernel must update the corresponding page table entries. The subroutine which handled this failed to take into account the presence of 1GB largepage mappings created using the shm_create_largepage(3) interface. In particular, it would always treat a page directory page entry as pointing to another page table page.

The bug can be abused by an unprivileged user to cause pmap_pkru_update_range() to treat userspace memory as a page table page, and thus overwrite memory to which the application would otherwise not have access.

NVD Source

Technical Analysis

CVE-2026-6386 requires local access, meaning attackers must already have a foothold on the target system.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 6.2.