CyberSecBulletin
CVE-2026-63808NVD status: Analyzed

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-63808 is a critical-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions e6f1a11cfb808441a43ffae9b476cc135732cd27, e48f413c2815787b8cade2795e194e3c4cd782ef, 06c4e1e9967d332ac33ba38b7819851089ff9359 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.53% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to e6f1a11cfb808441a43ffae9b476cc135732cd27 or e48f413c2815787b8cade2795e194e3c4cd782ef or 06c4e1e9967d332ac33ba38b7819851089ff9359 or 8e0abc17fbd7e305802e84fe98b4950d50f9c433, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.260 or 5.15.211 or 6.1.177 or 6.6.144, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxca06197382bde0a3bc20215595d1c9ce20c6e341 up to, but not including, e6f1a11cfb808441a43ffae9b476cc135732cd27; ca06197382bde0a3bc20215595d1c9ce20c6e341 up to, but not including, e48f413c2815787b8cade2795e194e3c4cd782ef; ca06197382bde0a3bc20215595d1c9ce20c6e341 up to, but not including, 06c4e1e9967d332ac33ba38b7819851089ff9359; ca06197382bde0a3bc20215595d1c9ce20c6e341 up to, but not including, 8e0abc17fbd7e305802e84fe98b4950d50f9c433; ca06197382bde0a3bc20215595d1c9ce20c6e341 up to, but not including, 4d101016d5e587f820b3ae2d5bb6770d86342649; ca06197382bde0a3bc20215595d1c9ce20c6e341 up to, but not including, adfacfbaeae2cb760f492357cc36b41f84ef7f86; ca06197382bde0a3bc20215595d1c9ce20c6e341 up to, but not including, 708b97e792945d3e4653939fd3405d71a61ad065; ca06197382bde0a3bc20215595d1c9ce20c6e341 up to, but not including, 3f5f8ee9917cc2b9076ac533492d8a200edcabb8; and 1 more rangese6f1a11cfb808441a43ffae9b476cc135732cd27, e48f413c2815787b8cade2795e194e3c4cd782ef, 06c4e1e9967d332ac33ba38b7819851089ff9359, 8e0abc17fbd7e305802e84fe98b4950d50f9c433, 4d101016d5e587f820b3ae2d5bb6770d86342649, adfacfbaeae2cb760f492357cc36b41f84ef7f86
LinuxLinux Kernel5.7 up to, but not including, 5.10.260; 5.11 up to, but not including, 5.15.211; 5.16 up to, but not including, 6.1.177; 6.2 up to, but not including, 6.6.144; 6.7 up to, but not including, 6.12.95; 6.13 up to, but not including, 6.18.38; 6.19 up to, but not including, 7.1.35.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.38

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: exfat: fix potential use-after-free in exfat_find_dir_entry() In exfat_find_dir_entry(), the buffer_head obtained from exfat_get_dentry() is released with brelse(bh) before the fall-through TYPE_EXTEND branch reads the directory entry through ep (which points into bh->b_data): brelse(bh); if (entry_type == TYPE_EXTEND) { ... len = exfat_extract_uni_name(ep, entry_uniname); ... } After brelse() drops our reference, nothing guarantees that the underlying page backing bh->b_data remains valid for the subsequent exfat_extract_uni_name() read. This is the same pattern fixed in commit fc961522ddbd ("exfat: Fix potential use after free in exfat_load_upcase_table()"). Move brelse(bh) so it runs after ep is no longer dereferenced on each branch. Confirmed on QEMU x86_64 with CONFIG_KASAN=y + CONFIG_DEBUG_PAGEALLOC=y + CONFIG_PAGE_POISONING=y on linux-next, using a crafted exFAT image (long filename with same-hash collisions forcing the TYPE_EXTEND path). With a debug-only invalidate_bdev() inserted between brelse(bh) and the ep read to make the stale-deref window deterministic, the unpatched kernel faults: BUG: KASAN: use-after-free in exfat_find_dir_entry+0x133b/0x15a0 BUG: unable to handle page fault for address: ffff88801a5fa0c2 Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI RIP: 0010:exfat_find_dir_entry+0x1188/0x15a0 With this patch applied, the same instrumented harness completes cleanly under the same sanitizer stack. I have not reproduced a crash on an uninstrumented kernel under ordinary reclaim; the instrumented A/B establishes the lifetime violation and that the patch closes it, not an unaided triggerability claim.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.