CyberSecBulletin
CVE-2026-63917NVD status: Analyzed

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-63917 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 0cdce7618464f7fb06f461e8f4ad575cb1d570f4, f5c68875e25f331e497ddfbe81e2d8163a87f136, d9c5eecdb3c740e65038651db7c686b10d76d1bc as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.17% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 0cdce7618464f7fb06f461e8f4ad575cb1d570f4 or f5c68875e25f331e497ddfbe81e2d8163a87f136 or d9c5eecdb3c740e65038651db7c686b10d76d1bc or f1e89a943ee574d0f2f16246eb3f2d7330fdeb03, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.259 or 5.15.210 or 6.1.176 or 6.6.143, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux61220ab349485d911083d0b7990ccd3db6c63297 up to, but not including, 0cdce7618464f7fb06f461e8f4ad575cb1d570f4; 61220ab349485d911083d0b7990ccd3db6c63297 up to, but not including, f5c68875e25f331e497ddfbe81e2d8163a87f136; 61220ab349485d911083d0b7990ccd3db6c63297 up to, but not including, d9c5eecdb3c740e65038651db7c686b10d76d1bc; 61220ab349485d911083d0b7990ccd3db6c63297 up to, but not including, f1e89a943ee574d0f2f16246eb3f2d7330fdeb03; 61220ab349485d911083d0b7990ccd3db6c63297 up to, but not including, 225b467e3b631f38be22e4b38062a1fed02fdd21; 61220ab349485d911083d0b7990ccd3db6c63297 up to, but not including, fc32be9ac2788524c6b24efd681cce7a6e731a92; 61220ab349485d911083d0b7990ccd3db6c63297 up to, but not including, ee1778ba0f5cb53be771f97017d01eb356c797bf; 61220ab349485d911083d0b7990ccd3db6c63297 up to, but not including, 11b326fb0a374f4654f9be22d0f0f7abd9f7d3fe; and 1 more ranges0cdce7618464f7fb06f461e8f4ad575cb1d570f4, f5c68875e25f331e497ddfbe81e2d8163a87f136, d9c5eecdb3c740e65038651db7c686b10d76d1bc, f1e89a943ee574d0f2f16246eb3f2d7330fdeb03, 225b467e3b631f38be22e4b38062a1fed02fdd21, fc32be9ac2788524c6b24efd681cce7a6e731a92
LinuxLinux Kernel3.15 up to, but not including, 5.10.259; 5.11 up to, but not including, 5.15.210; 5.16 up to, but not including, 6.1.176; 6.2 up to, but not including, 6.6.143; 6.7 up to, but not including, 6.12.93; 6.13 up to, but not including, 6.18.35; 6.19 up to, but not including, 7.0.12; 7.15.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
ChangedThe attack can reach beyond the vulnerable component into other systems.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9 ip netns del ns2 ip netns del ns1 [ 132.495484] ------------[ cut here ]------------ [ 132.497609] kernel BUG at net/core/dev.c:12376! Commit 61220ab34948 ("vti6: Enable namespace changing") dropped NETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then move through IFLA_NET_NS_FD. After the move dev_net(dev) points at the new netns while t->net stays at the creation netns. vti6_changelink() and vti6_update() still use dev_net(dev) and dev_net(t->dev). They unlink from one per netns hash and relink into another. The creation netns is left with a stale entry. cleanup_net() of that netns later walks freed memory. Reachable from an unprivileged user namespace (unshare --user --map-root-user --net). Cross tenant scope on container hosts.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.