CyberSecBulletin
CVE-2026-63906NVD status: Analyzed

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-63906 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 8.4 out of 10. It can be exploited with local access to the system by an unauthenticated attacker, without any action from a user. The record lists versions 632fd888fe33083927e29ef651ac1aba345edd9e, b987f380620b38c84f054d5ff5c05861a7c2203b, 27e62532228dc42367bb43ebbcd7bf49d8db2b0d as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.18% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 632fd888fe33083927e29ef651ac1aba345edd9e or b987f380620b38c84f054d5ff5c05861a7c2203b or 27e62532228dc42367bb43ebbcd7bf49d8db2b0d or 69f9f2b30af03d9b6e83f78fb0f734b6066d4678, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 6.1 or 6.1.176 or 6.6.143 or 6.12.93, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux22b60658a90260e3fbd57824e3afe5682c6afcf5 up to, but not including, 632fd888fe33083927e29ef651ac1aba345edd9e; ffbe2feac59b37c8dc536727552b4f375e1b9aec up to, but not including, b987f380620b38c84f054d5ff5c05861a7c2203b; ffbe2feac59b37c8dc536727552b4f375e1b9aec up to, but not including, 27e62532228dc42367bb43ebbcd7bf49d8db2b0d; ffbe2feac59b37c8dc536727552b4f375e1b9aec up to, but not including, 69f9f2b30af03d9b6e83f78fb0f734b6066d4678; ffbe2feac59b37c8dc536727552b4f375e1b9aec up to, but not including, d53e4c41331f57b9fd78cbf3e480c6ce20aea07b; ffbe2feac59b37c8dc536727552b4f375e1b9aec up to, but not including, e194ce048f5a6c549b3a23a8c568c6470f40f772; fed43efc00ba6ac8c6b95828cd5acfa3d45eca4d; 6.1.2 up to, but not including, 6.1.176; and 2 more ranges632fd888fe33083927e29ef651ac1aba345edd9e, b987f380620b38c84f054d5ff5c05861a7c2203b, 27e62532228dc42367bb43ebbcd7bf49d8db2b0d, 69f9f2b30af03d9b6e83f78fb0f734b6066d4678, d53e4c41331f57b9fd78cbf3e480c6ce20aea07b, e194ce048f5a6c549b3a23a8c568c6470f40f772
LinuxLinux Kernel6.0.16 up to, but not including, 6.1; 6.1.2 up to, but not including, 6.1.176; 6.2 up to, but not including, 6.6.143; 6.7 up to, but not including, 6.12.93; 6.13 up to, but not including, 6.18.35; 6.19 up to, but not including, 7.0.12; 7.16.1, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Fix use-after-free in omap2430_probe() In omap2430_probe(), of_node_put(np) is called prematurely before the last access to np, leading to a use-after-free if the node's reference count drops to zero. Move the of_node_put() calls after the last use of np in both the success and error paths.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.