CyberSecBulletin
CVE-2026-63905NVD status: Analyzed

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-63905 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 61704e5cf9cd7464b510eb606e7e2978b1160a64, dcc1c90b28b28b7c493547506297e78653f81952, 1036ac6148995feaf486014d32bf26bf993c06a9 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.17% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 61704e5cf9cd7464b510eb606e7e2978b1160a64 or dcc1c90b28b28b7c493547506297e78653f81952 or 1036ac6148995feaf486014d32bf26bf993c06a9 or a0638db2340ee053ab0450656a763fd111475e54, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.259 or 5.15.210 or 6.1.176 or 6.6.143, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxb6a0ca11186759ad7045d68a5447b1e89f658384 up to, but not including, 61704e5cf9cd7464b510eb606e7e2978b1160a64; b6a0ca11186759ad7045d68a5447b1e89f658384 up to, but not including, dcc1c90b28b28b7c493547506297e78653f81952; b6a0ca11186759ad7045d68a5447b1e89f658384 up to, but not including, 1036ac6148995feaf486014d32bf26bf993c06a9; b6a0ca11186759ad7045d68a5447b1e89f658384 up to, but not including, a0638db2340ee053ab0450656a763fd111475e54; b6a0ca11186759ad7045d68a5447b1e89f658384 up to, but not including, d07ed707467ce05ea9c03412d0c5ee9d0fe386a6; b6a0ca11186759ad7045d68a5447b1e89f658384 up to, but not including, 88d459e5b5a46da1ef9fd6f52d9439343edeec88; b6a0ca11186759ad7045d68a5447b1e89f658384 up to, but not including, 207bf80362df3fce8ebc9723351dcb1bc6d9ed0f; b6a0ca11186759ad7045d68a5447b1e89f658384 up to, but not including, d96209626a29ea64666be98c30b30ac82e5f1be6; and 1 more ranges61704e5cf9cd7464b510eb606e7e2978b1160a64, dcc1c90b28b28b7c493547506297e78653f81952, 1036ac6148995feaf486014d32bf26bf993c06a9, a0638db2340ee053ab0450656a763fd111475e54, d07ed707467ce05ea9c03412d0c5ee9d0fe386a6, 88d459e5b5a46da1ef9fd6f52d9439343edeec88
LinuxLinux Kernel4.7 up to, but not including, 5.10.259; 5.11 up to, but not including, 5.15.210; 5.16 up to, but not including, 6.1.176; 6.2 up to, but not including, 6.6.143; 6.7 up to, but not including, 6.12.93; 6.13 up to, but not including, 6.18.35; 6.19 up to, but not including, 7.0.12; 7.15.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: Fix use after free bug in vudc_remove due to race condition This patch follows up Zheng Wang's 2023 report of a use-after-free in vudc_remove(). The original thread stalled on Shuah Khan's request for runtime testing of the unplug/unbind path. This patch supplies that testing and keeps Zheng's original fix shape. In vudc_probe(), v_init_timer() binds udc->tr_timer.timer to v_timer(). usbip_sockfd_store() starts the timer via v_start_timer()/v_kick_timer(). vudc_remove() can then free the containing struct vudc while the timer is still pending or executing. KASAN confirms the race on an unpatched x86_64 QEMU guest with CONFIG_KASAN=y, CONFIG_USBIP_VUDC=y, CONFIG_USB_ZERO=y, and a tight loop that repeatedly writes a socket fd to usbip_sockfd, closes the socket pair, and unbinds/rebinds usbip-vudc.0: BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x8ba/0x8e0 Write of size 8 at addr ffff888001b80740 by task trigger_and_unb/239 Allocated by task 239: vudc_probe+0x4d/0xaa0 Freed by task 239: kfree+0x18f/0x520 device_release_driver_internal+0x388/0x540 unbind_store+0xd9/0x100 This lands in the timer core rather than v_timer() itself because the embedded timer_list is being walked after its containing struct vudc has already been freed. The underlying lifetime bug is the same one Zheng reported. With v_stop_timer() called from vudc_remove() and the timer deleted synchronously, the same harness completed 5000 bind/unbind iterations with no KASAN report.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.