CyberSecBulletin
CVE-2026-63806NVD status: Modified

Linux: Reachable Assertion

Published Updated By the CyberSecBulletin desk

CVE-2026-63806 is a high-severity reachable assertion vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an unauthenticated attacker, without any action from a user. The record lists versions 2426c15c1395b7d5ccf1e5025ca898af7f3decb6, 4186c850789906b875a1d263377a4d37c078e317, 36ff44fb3d89960391e013fb9d91e23dbc48be47 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.16% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 2426c15c1395b7d5ccf1e5025ca898af7f3decb6 or 4186c850789906b875a1d263377a4d37c078e317 or 36ff44fb3d89960391e013fb9d91e23dbc48be47 or 92fc631b69deb1c7d56aec2663003600799dcd75, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.261 or 5.15.212 or 6.1.178 or 6.6.145, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxd34e6b175e61821026893ec5298cc8e7558df43a up to, but not including, 2426c15c1395b7d5ccf1e5025ca898af7f3decb6; d34e6b175e61821026893ec5298cc8e7558df43a up to, but not including, 4186c850789906b875a1d263377a4d37c078e317; d34e6b175e61821026893ec5298cc8e7558df43a up to, but not including, 36ff44fb3d89960391e013fb9d91e23dbc48be47; d34e6b175e61821026893ec5298cc8e7558df43a up to, but not including, 92fc631b69deb1c7d56aec2663003600799dcd75; d34e6b175e61821026893ec5298cc8e7558df43a up to, but not including, bf89e3738480d33cd515b4a18900e8443d40cd2e; d34e6b175e61821026893ec5298cc8e7558df43a up to, but not including, 5da9b1a87ec7cc3489c27016313524769f12d9e0; d34e6b175e61821026893ec5298cc8e7558df43a up to, but not including, 5c87b47374682f69686068ad0a7779365a527b1c; d34e6b175e61821026893ec5298cc8e7558df43a up to, but not including, f1edbed787ba67988ed34e0132ca128b052b6ce8; and 1 more ranges2426c15c1395b7d5ccf1e5025ca898af7f3decb6, 4186c850789906b875a1d263377a4d37c078e317, 36ff44fb3d89960391e013fb9d91e23dbc48be47, 92fc631b69deb1c7d56aec2663003600799dcd75, bf89e3738480d33cd515b4a18900e8443d40cd2e, 5da9b1a87ec7cc3489c27016313524769f12d9e0
LinuxLinux Kernel2.6.32 up to, but not including, 5.10.261; 5.11 up to, but not including, 5.15.212; 5.16 up to, but not including, 6.1.178; 6.2 up to, but not including, 6.6.145; 6.7 up to, but not including, 6.12.95; 6.13 up to, but not including, 6.18.38; 6.19 up to, but not including, 7.1.35.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.95, 6.18.38

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
ChangedThe attack can reach beyond the vulnerable component into other systems.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Drop a BUG_ON() that has been reachable since it was first added, way back in 2009, and instead use get_unaligned() to perform potentially-unaligned accesses. For a given store, KVM x86's emulator tracks the entire value in the destination operand, x86_emulate_ctxt.dst. If the destination is memory, and the target splits multiple pages and/or is emulated MMIO, then KVM handles each fragment independently. E.g. on a page split starting at page offset 0xffc, KVM writes 4 bytes to the first page, then the remaining bytes to the second page, using ctxt->dst as the source for both (with appropriate offsets). If the destination splits a page *and* hits emulated MMIO on the second page, then KVM will complete the write to the first page, then emulate the MMIO access to the second page. If there is a datamatch-enabled ioeventfd at offset 0 of the second page, then KVM will process the remainder of the store as a potential ioeventfd signal. Putting it all together, if the guest emits a store that splits a page starting at page offset N, and the second page has a datamatch-enabled ioeventfd at offset 0, then KVM will check for datamatch using &dst.valptr[N] as the source. Due to dst (and thus dst.valptr) being 32-byte aligned, if N is not aligned to @len, the BUG_ON() fires. E.g. with a 16-byte store at page offset 0xffc, to an ioeventfd of len 8, all initial checks in ioeventfd_in_range() will succeed, and the BUG_ON() fires due to @val being 4-byte aligned, but not 8-byte aligned. ------------[ cut here ]------------ kernel BUG at arch/x86/kvm/../../../virt/kvm/eventfd.c:783! Oops: invalid opcode: 0000 [#1] SMP CPU: 0 UID: 1000 PID: 615 Comm: repro Not tainted 7.1.0-rc2-ff238429d1ea #365 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:ioeventfd_write+0x6c/0x70 [kvm] Call Trace: <TASK> __kvm_io_bus_write+0x85/0xb0 [kvm] kvm_io_bus_write+0x53/0x80 [kvm] vcpu_mmio_write+0x66/0xf0 [kvm] emulator_read_write_onepage+0x12a/0x540 [kvm] emulator_read_write+0x109/0x2b0 [kvm] x86_emulate_insn+0x4f8/0xfb0 [kvm] x86_emulate_instruction+0x181/0x790 [kvm] kvm_mmu_page_fault+0x313/0x630 [kvm] vmx_handle_exit+0x18a/0x590 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xc81/0x1c90 [kvm] kvm_vcpu_ioctl+0x2d5/0x970 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb7/0x890 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f19c931a9bf </TASK> Modules linked in: kvm_intel kvm irqbypass ---[ end trace 0000000000000000 ]--- In a perfect world, the fix would be to simply delete the BUG_ON(), as KVM x86 doesn't perform alignment checks on "normal" memory accesses at CPL0. Sadly, C99 ruins all the fun; while the x86 architecture plays nice, dereferencing an unaligned pointer directly is undefined behavior in C, e.g. triggers splats when running with CONFIG_UBSAN_ALIGNMENT=y.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

How developers prevent this class of flaw

  • If the assertion statement is required (e.g., for security or reliability), change the invoking code to avoid the conditions that trigger the assertion.
  • Consider changing the assertion to some other less fatal error. This might not be easy to implement, since other code may be needed to handle the error.
  • Make sensitive open/close operations non-reachable from directly user-controlled data (e.g. open/close resources)

More Reachable Assertion vulnerabilities (CWE-617)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Reachable Assertion vulnerabilities

Spotted an error? Tell us.