CyberSecBulletin
CVE-2026-63926NVD status: Analyzed

Linux: Incorrect Conversion between Numeric Types

Published Updated By the CyberSecBulletin desk

CVE-2026-63926 is a high-severity incorrect conversion between numeric types vulnerability in Linux, with a CVSS 3.1 base score of 8.4 out of 10. It can be exploited with local access to the system by an unauthenticated attacker, without any action from a user. The record lists versions f14609d8146707452e0822f3c8154674ce677251, d81b323af2dcee47573907ccb89c0df9b45cb2e2, aeb95146848d12206e1b2cfacd4f40e21ce81d94 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.19% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to f14609d8146707452e0822f3c8154674ce677251 or d81b323af2dcee47573907ccb89c0df9b45cb2e2 or aeb95146848d12206e1b2cfacd4f40e21ce81d94 or 96b72672ce849a1402730238e64d9b20bf06a96d, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.259 or 5.15.210 or 6.1.176 or 6.6.143, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux6fff607e2f14bd7c63c06c464a6f93b8efbabe28 up to, but not including, f14609d8146707452e0822f3c8154674ce677251; 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 up to, but not including, d81b323af2dcee47573907ccb89c0df9b45cb2e2; 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 up to, but not including, aeb95146848d12206e1b2cfacd4f40e21ce81d94; 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 up to, but not including, 96b72672ce849a1402730238e64d9b20bf06a96d; 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 up to, but not including, 3075c21d2d76c0067f4a382765b43d6cc10470f1; 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 up to, but not including, 5e19028667963fb371ebb00cecc2a473ef92056b; 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 up to, but not including, 63f64a510c7917658ddf4d073ece73914ee25346; 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 up to, but not including, f72eed9b84fb771019a955908132410a9ba9ea3f; and 1 more rangesf14609d8146707452e0822f3c8154674ce677251, d81b323af2dcee47573907ccb89c0df9b45cb2e2, aeb95146848d12206e1b2cfacd4f40e21ce81d94, 96b72672ce849a1402730238e64d9b20bf06a96d, 3075c21d2d76c0067f4a382765b43d6cc10470f1, 5e19028667963fb371ebb00cecc2a473ef92056b
LinuxLinux Kernel4.20 up to, but not including, 5.10.259; 5.11 up to, but not including, 5.15.210; 5.16 up to, but not including, 6.1.176; 6.2 up to, but not including, 6.6.143; 6.7 up to, but not including, 6.12.93; 6.13 up to, but not including, 6.18.35; 6.19 up to, but not including, 7.0.12; 7.15.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data When bpf_msg_push_data() inserts data in the middle of a scatterlist entry, it splits the original entry into a left fragment and a right fragment. The right fragment offset is page-local, but the code advances it with `start`, which is the message-global insertion point. For inserts into a non-first SG entry, this over-advances the offset and leaves the split layout inconsistent. Advance the right fragment offset by the fragment-local delta, `start - offset`, which matches the length removed from the front of the original entry.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Incorrect Conversion between Numeric Types

When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

How developers prevent this class of flaw

  • Avoid making conversion between numeric types. Always check for the allowed ranges.

More Incorrect Conversion between Numeric Types vulnerabilities (CWE-681)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Incorrect Conversion between Numeric Types vulnerabilities

Spotted an error? Tell us.