CyberSecBulletin
CVE-2026-63809NVD status: Analyzed

Linux: Release of Invalid Pointer or Reference

Published Updated By the CyberSecBulletin desk

CVE-2026-63809 is a high-severity release of invalid pointer or reference vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions d0a81ed5ff5d0f9c3f63a4f9e5a4642c363ecd3e, 77355ef7a9f6b0d2bdf65be3b37f2c1f365e20d2, e1d1e203a6000804c5d3b8a4aa4e52303c0c7ab2 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.15% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to d0a81ed5ff5d0f9c3f63a4f9e5a4642c363ecd3e or 77355ef7a9f6b0d2bdf65be3b37f2c1f365e20d2 or e1d1e203a6000804c5d3b8a4aa4e52303c0c7ab2 or 81fc9a13acae99966232f0e055eb2e445263b89a, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.260 or 5.15.211 or 6.1.177 or 6.6.144, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxb7925acd82926ebbf94a0f0783a3961f4e558856 up to, but not including, d0a81ed5ff5d0f9c3f63a4f9e5a4642c363ecd3e; 4508943794efdd94171549c0bd52810e2f4ad9fe up to, but not including, 77355ef7a9f6b0d2bdf65be3b37f2c1f365e20d2; 4508943794efdd94171549c0bd52810e2f4ad9fe up to, but not including, e1d1e203a6000804c5d3b8a4aa4e52303c0c7ab2; 4508943794efdd94171549c0bd52810e2f4ad9fe up to, but not including, 81fc9a13acae99966232f0e055eb2e445263b89a; 4508943794efdd94171549c0bd52810e2f4ad9fe up to, but not including, 838fe9c28121777c59a9406710a68fcf77bb8017; 4508943794efdd94171549c0bd52810e2f4ad9fe up to, but not including, 65bd0c0afb0e1bf3287458e342429b069624f7d4; 4508943794efdd94171549c0bd52810e2f4ad9fe up to, but not including, 70df4de46577fab5e25418f014583155a147c902; 4508943794efdd94171549c0bd52810e2f4ad9fe up to, but not including, 4c21b5927d4364bfe7365f2700da5fea0ed0d004; and 4 more rangesd0a81ed5ff5d0f9c3f63a4f9e5a4642c363ecd3e, 77355ef7a9f6b0d2bdf65be3b37f2c1f365e20d2, e1d1e203a6000804c5d3b8a4aa4e52303c0c7ab2, 81fc9a13acae99966232f0e055eb2e445263b89a, 838fe9c28121777c59a9406710a68fcf77bb8017, 65bd0c0afb0e1bf3287458e342429b069624f7d4
LinuxLinux Kernel5.10.20 up to, but not including, 5.10.260; 5.11.3 up to, but not including, 5.15.211; 5.16 up to, but not including, 6.1.177; 6.2 up to, but not including, 6.6.144; 6.7 up to, but not including, 6.12.95; 6.13 up to, but not including, 6.18.38; 6.19 up to, but not including, 7.1.35.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.38

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: bpf: use kvfree() for replaced sysctl write buffer proc_sys_call_handler() allocates its temporary sysctl buffer with kvzalloc() and passes it to __cgroup_bpf_run_filter_sysctl(). Since kvzalloc() may fall back to vmalloc() for large allocations, freeing that buffer with kfree() is wrong and can corrupt memory. Use kvfree() to safely handle both kmalloc and kvzalloc()/vmalloc allocations. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc5. Reproduced the bug based on v7.1-rc4 in a QEMU x86_64 guest booted with KASAN and CONFIG_FAILSLAB enabled. To exercise the replacement path, the test tree also included the accompanying fix for the stale ret == 1 check in __cgroup_bpf_run_filter_sysctl(). The reproducer confines failslab injections to the proc_sys_call_handler() range, uses stacktrace-depth=32, and injects fail-nth=1 while writing 8191 bytes to /proc/sys/kernel/domainname from a task in the target cgroup. Under that setup, fail-nth=1 triggered the fault: BUG: unable to handle page fault for address: ffffeb0200024d48 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 SMP KASAN NOPTI CPU: 2 UID: 0 PID: 209 Comm: repro_proc_sys_ Not tainted 7.1.0-rc4-00686-g97625979a5d4 PREEMPT(lazy) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 RIP: 0010:kfree+0x6e/0x510 ... Call Trace: <TASK> ? __cgroup_bpf_run_filter_sysctl+0x626/0xc30 __cgroup_bpf_run_filter_sysctl+0x74d/0xc30 ? __pfx___cgroup_bpf_run_filter_sysctl+0x10/0x10 ? srso_return_thunk+0x5/0x5f ? __kvmalloc_node_noprof+0x345/0x870 ? proc_sys_call_handler+0x250/0x480 ? srso_return_thunk+0x5/0x5f proc_sys_call_handler+0x3a2/0x480 ? __pfx_proc_sys_call_handler+0x10/0x10 ? srso_return_thunk+0x5/0x5f ? selinux_file_permission+0x39f/0x500 ? srso_return_thunk+0x5/0x5f ? lock_is_held_type+0x9e/0x120 vfs_write+0x98e/0x1000 ... </TASK> With this fix applied on top of the same test setup, rerunning the reproducer with fail-nth=1 yields no corresponding Oops reports.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Release of Invalid Pointer or Reference

The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.

How developers prevent this class of flaw

  • Only call matching memory management functions. Do not mix and match routines. For example, when you allocate a buffer with malloc(), dispose of the original pointer with free().
  • When programming in C++, consider using smart pointers provided by the boost library to help correctly and consistently manage memory.
  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, glibc in Linux provides protection against free of invalid pointers.

More Release of Invalid Pointer or Reference vulnerabilities (CWE-763)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Release of Invalid Pointer or Reference vulnerabilities

Spotted an error? Tell us.