Linux: Double Free
CVE-2026-63907 is a high-severity double free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions e344865bfca4eb37ed8d7ac5917226e49fcec7ce, f74c8696f14149d5e43cc28b015326a759c48f00 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.15% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to e344865bfca4eb37ed8d7ac5917226e49fcec7ce or f74c8696f14149d5e43cc28b015326a759c48f00, whichever matches your release line, or a later version.
- Update Linux Kernel to 7.0.12 or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 3397c3cd859a2c51962ad032dcf97961d42f9db2 up to, but not including, e344865bfca4eb37ed8d7ac5917226e49fcec7ce; 3397c3cd859a2c51962ad032dcf97961d42f9db2 up to, but not including, f74c8696f14149d5e43cc28b015326a759c48f00; 6.19 | e344865bfca4eb37ed8d7ac5917226e49fcec7ce, f74c8696f14149d5e43cc28b015326a759c48f00 |
| Linux | Linux Kernel | 6.19 up to, but not including, 7.0.12; 7.1 | 7.0.12 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
Official description
In the Linux kernel, the following vulnerability has been resolved: uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory uio_pci_sva allocates struct uio_pci_sva_dev with devm_kzalloc() in probe(), but then calls kfree(udev) both on the probe() error path (label out_free) and again in remove(). Because devm_kzalloc() allocations are devres-managed and are freed automatically when the device is detached (including after a failing probe() and during driver unbind), the explicit kfree() can lead to a double free. If probe() fails after devm_kzalloc(), the error path frees udev and devres cleanup will free it again when the core unwinds the partially bound device. On normal driver removal, remove() frees udev and devres will free it again when the device is detached. This issue was identified by a static analysis tool I developed and confirmed by manual review. Fix by removing the manual kfree() calls and dropping the now-unused label.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Double Free
The product calls free() twice on the same memory address.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly. If the language is object oriented, ensure that object destructors delete each chunk of memory only once.
- Use a static analysis tool to find double free instances.
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Recent Double Free vulnerabilities
- 8.4 High severity
- 7.8 High severity
- 9.8 Critical severity
- 7.8 High severity
- 8.7 High severity
- 9.8 Critical severity
Spotted an error? Tell us.