CyberSecBulletin
CVE-2026-63979NVD status: Analyzed

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-63979 is a critical-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions b869e3e4ce1996df23b3efdbbe9a64c4ab81d745, 2f28dbb30b88eafab8d49aaec94710b4e12dea8e, 68eba6519cbd6359fb554a9720f3a3b6b2eba23f as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.64% chance of exploitation within 30 days, higher than 51% of scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to b869e3e4ce1996df23b3efdbbe9a64c4ab81d745 or 2f28dbb30b88eafab8d49aaec94710b4e12dea8e or 68eba6519cbd6359fb554a9720f3a3b6b2eba23f or c06876d4fac38f35820946ee3b1be7d7da799cd4, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 6.6.160 or 6.12.114 or 6.18.44 or 7.0.12, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux3b3009ea8abb713b022d94fba95ec270cf6e7eae up to, but not including, b869e3e4ce1996df23b3efdbbe9a64c4ab81d745; 3b3009ea8abb713b022d94fba95ec270cf6e7eae up to, but not including, 2f28dbb30b88eafab8d49aaec94710b4e12dea8e; 3b3009ea8abb713b022d94fba95ec270cf6e7eae up to, but not including, 68eba6519cbd6359fb554a9720f3a3b6b2eba23f; 3b3009ea8abb713b022d94fba95ec270cf6e7eae up to, but not including, c06876d4fac38f35820946ee3b1be7d7da799cd4; 3b3009ea8abb713b022d94fba95ec270cf6e7eae up to, but not including, f4251190e58b209999c1ba9e6d2976136a1be055; 6.4b869e3e4ce1996df23b3efdbbe9a64c4ab81d745, 2f28dbb30b88eafab8d49aaec94710b4e12dea8e, 68eba6519cbd6359fb554a9720f3a3b6b2eba23f, c06876d4fac38f35820946ee3b1be7d7da799cd4, f4251190e58b209999c1ba9e6d2976136a1be055
LinuxLinux Kernel6.4 up to, but not including, 6.6.160; 6.7 up to, but not including, 6.12.114; 6.13 up to, but not including, 6.18.44; 6.19 up to, but not including, 7.0.12; 7.16.6.160, 6.12.114, 6.18.44, 7.0.12

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to accept_doit handshake_req_next() removes the request from the per-net pending list and drops hn_lock before handshake_nl_accept_doit() reads req->hr_sk->sk_socket and dereferences sock->file (once in FD_PREPARE() and again in get_file()). In that window a consumer running tls_handshake_cancel() followed by sockfd_put() (svc_sock_free) or __fput_sync() (xs_reset_transport) releases sock->file. sock_release() then runs sock_orphan(), zeroing sk_socket, and frees the struct socket. The accept-side code either reads NULL through sk_socket or chases freed memory. The submit-side sock_hold() does not prevent this. sk_refcnt protects struct sock, but struct socket and sock->file are independently refcounted via the file descriptor the consumer owns. Pinning sk leaves sock and sock->file unprotected. Retarget the accept-side dereferences at req->hr_file, which was pinned at submit time, instead of req->hr_sk->sk_socket->file. Pinning on its own is not sufficient: a consumer that cancels between handshake_req_next() returning and accept_doit reaching FD_PREPARE() takes the !remove_pending() branch in handshake_req_cancel() and drops hr_file before the accept side takes its own reference. Hand off an additional file reference inside handshake_req_next(), under hn_lock, so the accept side operates on a reference that no concurrent handshake_req_cancel() can revoke. FD_PREPARE() consumes that handed-off reference, either by transferring it to the new fd in fd_publish() or by dropping it in the cleanup destructor on error; the explicit get_file() that previously balanced FD_PREPARE() is therefore redundant and goes away. Update handshake_req_cancel_test2 and _test3 to simulate the FD_PREPARE() consumption with an fput() so the kunit file-count assertions stay balanced.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.