CVE-2026-63808 - Vulnerability Details

- exfat: fix potential use-after-free in exfat_find_dir_entry()

Description

In the Linux kernel, the following vulnerability has been resolved:

exfat: fix potential use-after-free in exfat_find_dir_entry()

In exfat_find_dir_entry(), the buffer_head obtained from
exfat_get_dentry() is released with brelse(bh) before the fall-through
TYPE_EXTEND branch reads the directory entry through ep (which points
into bh->b_data):

brelse(bh);
if (entry_type == TYPE_EXTEND) {
...
len = exfat_extract_uni_name(ep, entry_uniname);
...
}

After brelse() drops our reference, nothing guarantees that the
underlying page backing bh->b_data remains valid for the subsequent
exfat_extract_uni_name() read. This is the same pattern fixed in
commit fc961522ddbd ("exfat: Fix potential use after free in
exfat_load_upcase_table()").

Move brelse(bh) so it runs after ep is no longer dereferenced on
each branch.

Confirmed on QEMU x86_64 with CONFIG_KASAN=y + CONFIG_DEBUG_PAGEALLOC=y
+ CONFIG_PAGE_POISONING=y on linux-next, using a crafted exFAT image
(long filename with same-hash collisions forcing the TYPE_EXTEND path).
With a debug-only invalidate_bdev() inserted between brelse(bh) and
the ep read to make the stale-deref window deterministic, the
unpatched kernel faults:

BUG: KASAN: use-after-free in exfat_find_dir_entry+0x133b/0x15a0
BUG: unable to handle page fault for address: ffff88801a5fa0c2
Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI
RIP: 0010:exfat_find_dir_entry+0x1188/0x15a0

With this patch applied, the same instrumented harness completes
cleanly under the same sanitizer stack. I have not reproduced a
crash on an uninstrumented kernel under ordinary reclaim; the
instrumented A/B establishes the lifetime violation and that the
patch closes it, not an unaided triggerability claim.

Published: 2026-07-19

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw resides in the exfat driver’s directory entry lookup routine. A buffer_head is released before all references to its data are cleared, so a subsequent read can dereference freed memory. When a user mounts an exFAT filesystem containing a crafted entry that forces the TYPE_EXTEND branch, the kernel may crash or, in a vulnerable configuration, corrupt memory and allow an attacker to execute code with kernel rights.

Affected Systems

Every Linux kernel that includes the stock exFAT driver and does not contain the patch that moves the brelse() call after the data is accessed is vulnerable. This covers the default kernels shipped by Linux distributions where exfat support is enabled.

Risk and Exploitability

With a CVSS score of 9.8 the issue is classified as Critical. The EPSS score is below 1 %, indicating a very low likelihood of exploitation in the wild at the time of this analysis, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the vulnerability could be exploited locally or remotely by presenting a crafted exFAT image via a removable device or network share. If triggered, the use‑after‑free can cause a kernel panic, memory corruption, or arbitrarily execute code in ring 0, enabling privilege escalation or service disruption.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ca06197382bde0a3bc20215595d1c9ce20c6e341`	affected	< e6f1a11cfb808441a43ffae9b476cc135732cd27
`ca06197382bde0a3bc20215595d1c9ce20c6e341`	affected	< e48f413c2815787b8cade2795e194e3c4cd782ef
`ca06197382bde0a3bc20215595d1c9ce20c6e341`	affected	< 06c4e1e9967d332ac33ba38b7819851089ff9359
`ca06197382bde0a3bc20215595d1c9ce20c6e341`	affected	< 8e0abc17fbd7e305802e84fe98b4950d50f9c433
`ca06197382bde0a3bc20215595d1c9ce20c6e341`	affected	< 4d101016d5e587f820b3ae2d5bb6770d86342649
`ca06197382bde0a3bc20215595d1c9ce20c6e341`	affected	< adfacfbaeae2cb760f492357cc36b41f84ef7f86
`ca06197382bde0a3bc20215595d1c9ce20c6e341`	affected	< 708b97e792945d3e4653939fd3405d71a61ad065
`ca06197382bde0a3bc20215595d1c9ce20c6e341`	affected	< 3f5f8ee9917cc2b9076ac533492d8a200edcabb8

Linux

affected

Version	Status	Constraints
`5.7`	affected	—
`0`	unaffected	< 5.7
`5.10.260`	unaffected	≤ 5.10.*
`5.15.211`	unaffected	≤ 5.15.*
`6.1.177`	unaffected	≤ 6.1.*
`6.6.144`	unaffected	≤ 6.6.*
`6.12.95`	unaffected	≤ 6.12.*
`6.18.38`	unaffected	≤ 6.18.*
`7.1.3`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[ca06197382bde0a3bc20215595d1c9ce20c6e341,e6f1a11cfb808441a43ffae9b476cc135732cd27)`	affected	code_commit	—
`[ca06197382bde0a3bc20215595d1c9ce20c6e341,e48f413c2815787b8cade2795e194e3c4cd782ef)`	affected	code_commit	—
`[ca06197382bde0a3bc20215595d1c9ce20c6e341,06c4e1e9967d332ac33ba38b7819851089ff9359)`	affected	code_commit	—
`[ca06197382bde0a3bc20215595d1c9ce20c6e341,8e0abc17fbd7e305802e84fe98b4950d50f9c433)`	affected	code_commit	—
`[ca06197382bde0a3bc20215595d1c9ce20c6e341,4d101016d5e587f820b3ae2d5bb6770d86342649)`	affected	code_commit	—
`[ca06197382bde0a3bc20215595d1c9ce20c6e341,adfacfbaeae2cb760f492357cc36b41f84ef7f86)`	affected	code_commit	—
`[ca06197382bde0a3bc20215595d1c9ce20c6e341,708b97e792945d3e4653939fd3405d71a61ad065)`	affected	code_commit	—
`[ca06197382bde0a3bc20215595d1c9ce20c6e341,3f5f8ee9917cc2b9076ac533492d8a200edcabb8)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.7`	affected	semver	—
`[0,5.7)`	unaffected	semver	—
`[5.10.260,5.11.0)`	unaffected	semver	—
`[5.15.211,5.16.0)`	unaffected	semver	—
`[6.1.177,6.2.0)`	unaffected	semver	—
`[6.6.144,6.7.0)`	unaffected	semver	—
`[6.12.95,6.13.0)`	unaffected	semver	—
`[6.18.38,6.19.0)`	unaffected	semver	—
`[7.1.3,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the commit moving brelse() after the data read – this is the official remediation for the vulnerability.
If a kernel update cannot be applied immediately, prevent the exFAT driver from loading by blacklisting it in /etc/modprobe.d/blacklist-exfat.conf or by unloading the module with modprobe -r exfat before mounting exFAT filesystems.
After applying the patch or disabling the driver, re‑audit mounted exFAT volumes and ensure no remnant filesystems remain that could be exploited.

Generated by OpenCVE AI on July 30, 2026 at 22:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4700-1	linux-6.1 security update
Debian DLA	DLA-4717-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.005.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/06c4e1e9967d332ac33ba38b7819851089ff9359
https://git.kernel.org/stable/c/3f5f8ee9917cc2b9076ac533492d8a200edcabb8
https://git.kernel.org/stable/c/4d101016d5e587f820b3ae2d5bb6770d86342649
https://git.kernel.org/stable/c/708b97e792945d3e4653939fd3405d71a61ad065
https://git.kernel.org/stable/c/8e0abc17fbd7e305802e84fe98b4950d50f9c433
https://git.kernel.org/stable/c/adfacfbaeae2cb760f492357cc36b41f84ef7f86
https://git.kernel.org/stable/c/e48f413c2815787b8cade2795e194e3c4cd782ef
https://git.kernel.org/stable/c/e6f1a11cfb808441a43ffae9b476cc135732cd27
https://lore.kernel.org/linux-cve-announce/2026071902-CVE-2026-63808-263b@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63808
https://www.cve.org/CVERecord?id=CVE-2026-63808

History

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026071902-CVE-2026-63808-263b@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63808 https://www.cve.org/CVERecord?id=CVE-2026-63808
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: exfat: fix potential use-after-free in exfat_find_dir_entry() In exfat_find_dir_entry(), the buffer_head obtained from exfat_get_dentry() is released with brelse(bh) before the fall-through TYPE_EXTEND branch reads the directory entry through ep (which points into bh->b_data): brelse(bh); if (entry_type == TYPE_EXTEND) { ... len = exfat_extract_uni_name(ep, entry_uniname); ... } After brelse() drops our reference, nothing guarantees that the underlying page backing bh->b_data remains valid for the subsequent exfat_extract_uni_name() read. This is the same pattern fixed in commit fc961522ddbd ("exfat: Fix potential use after free in exfat_load_upcase_table()"). Move brelse(bh) so it runs after ep is no longer dereferenced on each branch. Confirmed on QEMU x86_64 with CONFIG_KASAN=y + CONFIG_DEBUG_PAGEALLOC=y + CONFIG_PAGE_POISONING=y on linux-next, using a crafted exFAT image (long filename with same-hash collisions forcing the TYPE_EXTEND path). With a debug-only invalidate_bdev() inserted between brelse(bh) and the ep read to make the stale-deref window deterministic, the unpatched kernel faults: BUG: KASAN: use-after-free in exfat_find_dir_entry+0x133b/0x15a0 BUG: unable to handle page fault for address: ffff88801a5fa0c2 Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI RIP: 0010:exfat_find_dir_entry+0x1188/0x15a0 With this patch applied, the same instrumented harness completes cleanly under the same sanitizer stack. I have not reproduced a crash on an uninstrumented kernel under ordinary reclaim; the instrumented A/B establishes the lifetime violation and that the patch closes it, not an unaided triggerability claim.
Title		exfat: fix potential use-after-free in exfat_find_dir_entry()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/06c4e1e9967d332ac33ba38b7819851089ff9359 https://git.kernel.org/stable/c/3f5f8ee9917cc2b9076ac533492d8a200edcabb8 https://git.kernel.org/stable/c/4d101016d5e587f820b3ae2d5bb6770d86342649 https://git.kernel.org/stable/c/708b97e792945d3e4653939fd3405d71a61ad065 https://git.kernel.org/stable/c/8e0abc17fbd7e305802e84fe98b4950d50f9c433 https://git.kernel.org/stable/c/adfacfbaeae2cb760f492357cc36b41f84ef7f86 https://git.kernel.org/stable/c/e48f413c2815787b8cade2795e194e3c4cd782ef https://git.kernel.org/stable/c/e6f1a11cfb808441a43ffae9b476cc135732cd27

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T12:02:11.323Z

Updated: 2026-08-05T12:35:55.993Z

Reserved: 2026-07-19T07:54:57.013Z

Link: CVE-2026-63808

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63808 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T22:30:06Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object