Linux: Out-of-bounds Read
CVE-2026-63912 is a critical-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 566295735530ee513326049b0540f32ec050bf2e, 5d7ab86e2b6bc23054616bf6ac562013bf60af8c, 36519e3d941fc99d3b52c134dbaf311f987a4708 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.71% chance of exploitation within 30 days, higher than 54% of scored CVEs.
Critical severity: a successful attack would have severe impact.
What to do
- Update Linux to 566295735530ee513326049b0540f32ec050bf2e or 5d7ab86e2b6bc23054616bf6ac562013bf60af8c or 36519e3d941fc99d3b52c134dbaf311f987a4708 or 322e48187e0245ab2fff6fec2220b0cae677dbec, whichever matches your release line, or a later version.
- Update Linux Kernel to 4.15 or 4.20 or 5.5 or 5.10.259, whichever matches your release line, or a later version.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | c075c3ea031757f8ea2d34567565b61a868c08d5 up to, but not including, 566295735530ee513326049b0540f32ec050bf2e; a583f2f3c8788bffd7fd7baeb76bd6d80543d7ea up to, but not including, 5d7ab86e2b6bc23054616bf6ac562013bf60af8c; 5bd8baab087dff657e05387aee802e70304cc813 up to, but not including, 36519e3d941fc99d3b52c134dbaf311f987a4708; 5bd8baab087dff657e05387aee802e70304cc813 up to, but not including, 322e48187e0245ab2fff6fec2220b0cae677dbec; 5bd8baab087dff657e05387aee802e70304cc813 up to, but not including, b84091ceddc9f133229dceab3ccc930bf27f9cba; 5bd8baab087dff657e05387aee802e70304cc813 up to, but not including, c093468aea8277f77272a4f199b2e15e19cabb59; 5bd8baab087dff657e05387aee802e70304cc813 up to, but not including, 65f3b3fc2347b89fe21db1e92c7681368415f095; 5bd8baab087dff657e05387aee802e70304cc813 up to, but not including, dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40; and 11 more ranges | 566295735530ee513326049b0540f32ec050bf2e, 5d7ab86e2b6bc23054616bf6ac562013bf60af8c, 36519e3d941fc99d3b52c134dbaf311f987a4708, 322e48187e0245ab2fff6fec2220b0cae677dbec, b84091ceddc9f133229dceab3ccc930bf27f9cba, c093468aea8277f77272a4f199b2e15e19cabb59 |
| Linux | Linux Kernel | 4.14.288 up to, but not including, 4.15; 4.19.252 up to, but not including, 4.20; 5.4.205 up to, but not including, 5.5; 5.10.113 up to, but not including, 5.10.259; 5.15.36 up to, but not including, 5.15.210; 5.17.5 up to, but not including, 5.18; 5.18.1 up to, but not including, 6.1.176; 6.2 up to, but not including, 6.6.143; and 5 more ranges | 4.15, 4.20, 5.5, 5.10.259, 5.15.210, 5.18 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in esp_output_head() before esp_output_tail() allocates the destination page frag. The head-side gate currently checks skb->data_len and tailen separately, but the tail code allocates a single destination frag from the combined post-trailer skb->data_len. Reject the page-frag fast path when the combined aligned length exceeds a page. Otherwise skb_page_frag_refill() may fall back to a single page while the destination sg still spans the combined skb->data_len. Restore this combined-length page gate for both IPv4 and IPv6.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
How developers prevent this class of flaw
- Use a language that provides appropriate memory abstractions.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/322e48187e0245ab2fff6fec2220b0cae677dbec
- git.kernel.org/stable/c/36519e3d941fc99d3b52c134dbaf311f987a4708
- git.kernel.org/stable/c/566295735530ee513326049b0540f32ec050bf2e
- git.kernel.org/stable/c/5d7ab86e2b6bc23054616bf6ac562013bf60af8c
- git.kernel.org/stable/c/65f3b3fc2347b89fe21db1e92c7681368415f095
- git.kernel.org/stable/c/b84091ceddc9f133229dceab3ccc930bf27f9cba
- git.kernel.org/stable/c/c093468aea8277f77272a4f199b2e15e19cabb59
- git.kernel.org/stable/c/dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40
Recent Out-of-bounds Read vulnerabilities
- 7.1 High severity
- 7.8 High severity
- 7.3 High severity
- 7.1 High severity
- 7.8 High severity
- 9.8 Critical severity
Spotted an error? Tell us.