CyberSecBulletin
CVE-2026-63812NVD status: Analyzed

Linux: Improper Initialization

Published Updated By the CyberSecBulletin desk

CVE-2026-63812 is a high-severity improper initialization vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 7e4d8f98be63f98856a5176b9188dada6e7ba9ee, 58a5deb220bcac4c73bf58954c0845644c997487, 20190e498057997532c7f186d081011f18e0a462 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.13% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 7e4d8f98be63f98856a5176b9188dada6e7ba9ee or 58a5deb220bcac4c73bf58954c0845644c997487 or 20190e498057997532c7f186d081011f18e0a462 or edf12cbeeeabe799bd2ee21fdb5c336cce6fbad7, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 6.2 or 6.6.144 or 6.12.95 or 6.18.38, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux42dd1c91f993431d0b399502479d00e6ad1bca71 up to, but not including, 7e4d8f98be63f98856a5176b9188dada6e7ba9ee; ab1eaf9d5c99042f5b0243bf67a06283a4c0757f up to, but not including, 58a5deb220bcac4c73bf58954c0845644c997487; b0e4395870eb3441ddc959f6710b5f6ca61aff26 up to, but not including, 20190e498057997532c7f186d081011f18e0a462; ed78aeebef05212ef7dca93bd931e4eff67c113f up to, but not including, edf12cbeeeabe799bd2ee21fdb5c336cce6fbad7; ed78aeebef05212ef7dca93bd931e4eff67c113f up to, but not including, 1f70ddb28a3c71df124da5fa4040c808116d6bb9; b00e6950da9c0e4986f6e93c875d2b9184bdb220; 0559a0e962aacbb47519e26ee663be04b72dcb92; 6.6.140 up to, but not including, 6.6.144; and 5 more ranges7e4d8f98be63f98856a5176b9188dada6e7ba9ee, 58a5deb220bcac4c73bf58954c0845644c997487, 20190e498057997532c7f186d081011f18e0a462, edf12cbeeeabe799bd2ee21fdb5c336cce6fbad7, 1f70ddb28a3c71df124da5fa4040c808116d6bb9, 6.6.144
LinuxLinux Kernel6.1.191 up to, but not including, 6.2; 6.6.140 up to, but not including, 6.6.144; 6.12.88 up to, but not including, 6.12.95; 6.18.30 up to, but not including, 6.18.38; 7.0.7 up to, but not including, 7.1.36.2, 6.6.144, 6.12.95, 6.18.38, 7.1.3

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() When __destroy_extent_node() sets the inode flag FI_NO_EXTENT, it does not reset the length of the largest extent to 0 and update the inode folio. Since modifications to the extent tree are disallowed afterward, the cached largest extent may become stale. This can trigger the following error in xfstests generic/388: F2FS-fs (dm-0): sanity_check_extent_cache: inode (ino=1761) extent info [220057, 57, 6] is incorrect, run fsck to fix In the f2fs_drop_inode path, __destroy_extent_node() does not need to guarantee that et->node_cnt is 0, because concurrency with writeback is expected in this path, and writeback may update the extent cache. This patch reverts commit ed78aeebef05 ("f2fs: fix node_cnt race between extent node destroy and writeback"), and remove the unnecessary zero check of et->node_cnt.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Initialization

The product does not initialize or incorrectly initializes a resource.

How developers prevent this class of flaw

  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, in Java, if the programmer does not explicitly initialize a variable, then the code could produce a compile-time error (if the variable is local) or automatically initialize the variable to the default value for the variable's type. In Perl, if explicit initialization is not performed, then a default value of undef is assigned, which is interpreted as 0, false, or an equivalent value depending on the context in which the variable is accessed.
  • Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
  • Explicitly initialize all your variables and other data stores, either during declaration or just before the first usage.

More Improper Initialization vulnerabilities (CWE-665)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent Improper Initialization vulnerabilities

Spotted an error? Tell us.