CyberSecBulletin
CVE-2026-63814NVD status: Analyzed

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-63814 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 733cd8474e6d763d75ed96f3f2b98a25480cf2b9, 4e2a96ec7236e248e706850568e0a925fd21b588, 442ca20c54038e2400cf28aaa944cf1de2c8e65d as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.13% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 733cd8474e6d763d75ed96f3f2b98a25480cf2b9 or 4e2a96ec7236e248e706850568e0a925fd21b588 or 442ca20c54038e2400cf28aaa944cf1de2c8e65d or 1ddf3fd21c4c652f9cab5552515c04a166662306, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.260 or 5.15.211 or 6.1.177 or 6.6.144, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxaf48b85b8cd3fbb12c9b6759c16db6d69c0b03da up to, but not including, 733cd8474e6d763d75ed96f3f2b98a25480cf2b9; af48b85b8cd3fbb12c9b6759c16db6d69c0b03da up to, but not including, 4e2a96ec7236e248e706850568e0a925fd21b588; af48b85b8cd3fbb12c9b6759c16db6d69c0b03da up to, but not including, 442ca20c54038e2400cf28aaa944cf1de2c8e65d; af48b85b8cd3fbb12c9b6759c16db6d69c0b03da up to, but not including, 1ddf3fd21c4c652f9cab5552515c04a166662306; af48b85b8cd3fbb12c9b6759c16db6d69c0b03da up to, but not including, aba4f94ac1832c7299c33e1b4fe5f87eef6dc8f1; af48b85b8cd3fbb12c9b6759c16db6d69c0b03da up to, but not including, ff83de56882cb8466184d322abece2589258ca56; af48b85b8cd3fbb12c9b6759c16db6d69c0b03da up to, but not including, 5d8a39649947a4e86c8fbc682d7fc0041b8d109a; af48b85b8cd3fbb12c9b6759c16db6d69c0b03da up to, but not including, c4810ada31e80cbe4011467c4f3b1e93f94134f3; and 1 more ranges733cd8474e6d763d75ed96f3f2b98a25480cf2b9, 4e2a96ec7236e248e706850568e0a925fd21b588, 442ca20c54038e2400cf28aaa944cf1de2c8e65d, 1ddf3fd21c4c652f9cab5552515c04a166662306, aba4f94ac1832c7299c33e1b4fe5f87eef6dc8f1, ff83de56882cb8466184d322abece2589258ca56
LinuxLinux Kernel3.8 up to, but not including, 5.10.260; 5.11 up to, but not including, 5.15.211; 5.16 up to, but not including, 6.1.177; 6.2 up to, but not including, 6.6.144; 6.7 up to, but not including, 6.12.95; 6.13 up to, but not including, 6.18.38; 6.19 up to, but not including, 7.1.35.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.38

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate ACL entry sizes in f2fs_acl_from_disk() f2fs_acl_count() only validates the aggregate ACL xattr length. A malformed ACL can still place ACL_USER or ACL_GROUP in a slot that only contains struct f2fs_acl_entry_short bytes, and f2fs_acl_from_disk() then reads entry->e_id before verifying that a full entry fits. Require a short entry before reading e_tag and e_perm, and require a full entry before reading e_id for ACL_USER and ACL_GROUP. Return -EFSCORRUPTED from these new truncated-entry checks, while keeping the pre-existing -EINVAL paths unchanged. Validation reproduced this kernel report: KASAN slab-out-of-bounds in __f2fs_get_acl+0x6fb/0x7e0 RIP: 0033:0x7f4b835ea7aa The buggy address belongs to the object at ffff888114589960 which belongs to the cache kmalloc-8 of size 8 The buggy address is located 0 bytes to the right of allocated 8-byte region [ffff888114589960, ffff888114589968) Read of size 4 Call trace: dump_stack_lvl+0x66/0xa0 (?:?) print_report+0xce/0x630 (?:?) __f2fs_get_acl+0x6fb/0x7e0 (fs/f2fs/acl.c:169) srso_alias_return_thunk+0x5/0xfbef5 (?:?) __virt_addr_valid+0x224/0x430 (?:?) kasan_report+0xe0/0x110 (?:?) __f2fs_get_acl+0x5/0x7e0 (fs/f2fs/acl.c:169) __get_acl+0x281/0x380 (?:?) vfs_get_acl+0x10b/0x190 (?:?) do_get_acl+0x2a/0x410 (?:?) do_get_acl+0x9/0x410 (?:?) do_getxattr+0xe8/0x260 (?:?) filename_getxattr+0xd1/0x140 (?:?) do_getname+0x2d/0x2d0 (?:?) path_getxattrat+0x16c/0x200 (?:?) lock_release+0xc8/0x290 (?:?) cgroup_update_frozen+0x9d/0x320 (?:?) lockdep_hardirqs_on_prepare+0xea/0x1a0 (?:?) trace_hardirqs_on+0x1a/0x170 (?:?) _raw_spin_unlock_irq+0x28/0x50 (?:?) do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87) entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.