CyberSecBulletin
CVE-2026-63807NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-63807 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 7b52008023b7facf40fba3ebe92449bda8ea53b9, 5cab1c989f938f5e1b9a0de66486f1fc2c28479b, 48b91ed7e22bb82571c34f8b80b6ecdc90a6fab8 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.17% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 7b52008023b7facf40fba3ebe92449bda8ea53b9 or 5cab1c989f938f5e1b9a0de66486f1fc2c28479b or 48b91ed7e22bb82571c34f8b80b6ecdc90a6fab8 or c5c29b3c268332afe67d598a034c58344540ed92, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.15.211 or 6.1.177 or 6.6.144 or 6.12.95, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux9eba50f8d7fcb61774f160890f98239fa3ab68a6 up to, but not including, 7b52008023b7facf40fba3ebe92449bda8ea53b9; 9eba50f8d7fcb61774f160890f98239fa3ab68a6 up to, but not including, 5cab1c989f938f5e1b9a0de66486f1fc2c28479b; 9eba50f8d7fcb61774f160890f98239fa3ab68a6 up to, but not including, 48b91ed7e22bb82571c34f8b80b6ecdc90a6fab8; 9eba50f8d7fcb61774f160890f98239fa3ab68a6 up to, but not including, c5c29b3c268332afe67d598a034c58344540ed92; 9eba50f8d7fcb61774f160890f98239fa3ab68a6 up to, but not including, 18587f9831612e24cd8f24be1ec15478feff7abc; 9eba50f8d7fcb61774f160890f98239fa3ab68a6 up to, but not including, b2ae3245ea44dccaa9af676b6747476951883318; 9eba50f8d7fcb61774f160890f98239fa3ab68a6 up to, but not including, ef057cbf825e03b63f6edf5980f96abf3c53089d; 5.127b52008023b7facf40fba3ebe92449bda8ea53b9, 5cab1c989f938f5e1b9a0de66486f1fc2c28479b, 48b91ed7e22bb82571c34f8b80b6ecdc90a6fab8, c5c29b3c268332afe67d598a034c58344540ed92, 18587f9831612e24cd8f24be1ec15478feff7abc, b2ae3245ea44dccaa9af676b6747476951883318
LinuxLinux Kernel5.12 up to, but not including, 5.15.211; 5.16 up to, but not including, 6.1.177; 6.2 up to, but not including, 6.6.144; 6.7 up to, but not including, 6.12.95; 6.13 up to, but not including, 6.18.38; 6.19 up to, but not including, 7.1.35.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
ChangedThe attack can reach beyond the vulnerable component into other systems.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level When recovering hugepages in the shadow MMU, verify that the base gfn of the shadow page is actually contained within the target memslot, *before* querying the max mapping level given the shadow page's gfn. Failure to pre-check the validity of the gfn can lead to an out-of-bounds access to the slot's lpage_info (which typically manifests as a host #PF because the lpage_info is vmalloc'd) if the guest creates a hugepage mapping (in its PTEs) that extends "below" the bounds of a memslot. When faulting in memory for a guest, and the size of the guest mapping is greater than KVM's (current) max mapping, then KVM will create a "direct" shadow page (direct in that there are no gPTEs to shadow, and so the target gfn is a direct calculation given the base gfn of the shadow page). The hugepage recovery flow looks for such direct shadow pages, as forcing 4KiB mappings when dirty logging generates the guest > host mapping size case. When the 4KiB restriction is lifted, then KVM can replace the shadow page with a hugepage. But if KVM originally used a smaller mapping than the guest because the range of memory covered by the guest hugepage exceeds the bounds of a memslot, then KVM will link a direct shadow page with a gfn that is outside the bounds of the memslot being used to fault in memory. The rmap entry added for the leaf mapping is correct and within bounds, but the gfn of the leaf SPTE's parent shadow page will be out of bounds. BUG: unable to handle page fault for address: ffffc90000806ffc #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 100000067 P4D 100000067 PUD 1002a7067 PMD 10612f067 PTE 0 Oops: Oops: 0000 [#1] SMP CPU: 13 UID: 1000 PID: 757 Comm: mmu_stress_test Not tainted 7.1.0-rc1-48ce1e26eace-x86_pir_to_irr_comments-vm #341 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:kvm_mmu_max_mapping_level+0x79/0x2b0 [kvm] Call Trace: <TASK> kvm_mmu_recover_huge_pages+0x21b/0x320 [kvm] kvm_set_memslot+0x1ee/0x590 [kvm] kvm_set_memory_region.part.0+0x3a1/0x4d0 [kvm] kvm_vm_ioctl+0x9bf/0x15d0 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb7/0xbb0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f21c0f1a9bf </TASK> Don't bother pre-checking the bounds of the potential hugepage, i.e. don't check that e.g. sp->gfn + KVM_PAGES_PER_HPAGE(sp->role.level + 1) is also within the memslot, as the checks performed by kvm_mmu_max_mapping_level() are a superset of the basic bounds checks. I.e. pre-checking the full range would be a dubious micro-optimization.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.