CVE-2026-63810 - Vulnerability Details

- block: Avoid mounting the bdev pseudo-filesystem in userspace

Description

In the Linux kernel, the following vulnerability has been resolved:

block: Avoid mounting the bdev pseudo-filesystem in userspace

The bdev pseudo-filesystem is an internal kernel filesystem with which
userspace should not interfere. Unregister it so that userspace cannot
even attempt to mount it.

This fixes a bug [1] that occurs when attempting to access files,
because the system call move_mount() uses pointers declared in the
inode_operations structure, which for the bdev pseudo-filesystem
are always equal to 0. `inode->i_op = &empty_iops;`

[1]

BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 23380067 P4D 23380067 PUD 23381067 PMD 0
Oops: 0010 [#1] PREEMPT SMP KASAN NOPTI
CPU: 2 PID: 17125 Comm: syz-executor.0 Not tainted 6.1.155-syzkaller-00350-g84221fde2681 #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:0x0

Call Trace:
<TASK>
lookup_open.isra.0+0x700/0x1180 fs/namei.c:3460
open_last_lookups fs/namei.c:3550 [inline]
path_openat+0x953/0x2700 fs/namei.c:3780
do_filp_open+0x1c5/0x410 fs/namei.c:3810
do_sys_openat2+0x171/0x4d0 fs/open.c:1318
do_sys_open fs/open.c:1334 [inline]
__do_sys_openat fs/open.c:1350 [inline]
__se_sys_openat fs/open.c:1345 [inline]
__x64_sys_openat+0x13c/0x1f0 fs/open.c:1345
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x6e/0xd8

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Published: 2026-07-19

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The bug is triggered when the kernel system call move_mount attempts to access inode operations for the bdev pseudo‑filesystem; those structures are intentionally set to null, leading to a NULL pointer dereference and an immediate kernel panic. The resulting denial of service undermines system availability and illustrates a classic null pointer dereference weakness (CWE‑476).

Affected Systems

All Linux kernel implementations that contain the bdev pseudo‑filesystem layer are affected; the vulnerability is present in every kernel revision prior to the application of the patch that removes or unregisters this pseudo‑filesystem. No vendor‑specific release numbers are supplied, so any kernel in use before the fix should be considered at risk.

Risk and Exploitability

The CVSS score of 5.5 places this issue in the moderate range, while the EPSS score of < 1% suggests that little to no exploitation activity has been observed to date. The bug is not listed in the CISA KEV catalog. Based on the description, it is inferred that the vulnerability could be triggered by a process that invokes move_mount on the bdev pseudo‑filesystem, which may require elevated privileges or a compromised local user. Given the low EPSS and moderate severity, administrators should treat this as a medium‑risk issue that benefits from timely patching.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 3d3fcf23993bb756de2f912ab631cfdcc4746554
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 99cde0a7b1e98fd3970aabef1300918e91698dd5
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 1a02a5028bd6dead1f8503854ef3168d651cd417
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 197971e6ffc0a6356b2ba2b22beb42bc0f7e412d
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 3804e6de30ae7b053d53341d9d6944356cf23b40
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 717f721eb67d2dacd3ed5f7495aef2f442e84ce4
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< f73aa66dffcb8e61e78f01b56163ec16a15d06d2

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.95`	unaffected	≤ 6.12.*
`6.18.38`	unaffected	≤ 6.18.*
`7.1.3`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,197971e6ffc0a6356b2ba2b22beb42bc0f7e412d)`	affected	code_commit	—
`[197971e6ffc0a6356b2ba2b22beb42bc0f7e412d,3804e6de30ae7b053d53341d9d6944356cf23b40)`	affected	code_commit	—
`[3804e6de30ae7b053d53341d9d6944356cf23b40,717f721eb67d2dacd3ed5f7495aef2f442e84ce4)`	affected	code_commit	—
`[717f721eb67d2dacd3ed5f7495aef2f442e84ce4,f73aa66dffcb8e61e78f01b56163ec16a15d06d2)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[6.12.95,6.13.0)`	unaffected	semver	—
`[6.18.38,6.19.0)`	unaffected	semver	—
`[7.1.3,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to a Linux kernel version that has unregistered the bdev pseudo‑filesystem.
Verify that no user‑space or automation scripts attempt to mount the bdev pseudo‑filesystem, and remove or disable such scripts.
Monitor the system for kernel panics or crashes that may indicate an attempt to trigger the vulnerability.

Generated by OpenCVE AI on July 30, 2026 at 22:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00183.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/197971e6ffc0a6356b2ba2b22beb42bc0f7e412d
https://git.kernel.org/stable/c/1a02a5028bd6dead1f8503854ef3168d651cd417
https://git.kernel.org/stable/c/3804e6de30ae7b053d53341d9d6944356cf23b40
https://git.kernel.org/stable/c/3d3fcf23993bb756de2f912ab631cfdcc4746554
https://git.kernel.org/stable/c/717f721eb67d2dacd3ed5f7495aef2f442e84ce4
https://git.kernel.org/stable/c/99cde0a7b1e98fd3970aabef1300918e91698dd5
https://git.kernel.org/stable/c/f73aa66dffcb8e61e78f01b56163ec16a15d06d2
https://lore.kernel.org/linux-cve-announce/2026071903-CVE-2026-63810-f30d@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63810
https://www.cve.org/CVERecord?id=CVE-2026-63810

History

Fri, 24 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/1a02a5028bd6dead1f8503854ef3168d651cd417 https://git.kernel.org/stable/c/3d3fcf23993bb756de2f912ab631cfdcc4746554 https://git.kernel.org/stable/c/99cde0a7b1e98fd3970aabef1300918e91698dd5

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://lore.kernel.org/linux-cve-announce/2026071903-CVE-2026-63810-f30d@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63810 https://www.cve.org/CVERecord?id=CVE-2026-63810
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Sun, 19 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: block: Avoid mounting the bdev pseudo-filesystem in userspace The bdev pseudo-filesystem is an internal kernel filesystem with which userspace should not interfere. Unregister it so that userspace cannot even attempt to mount it. This fixes a bug [1] that occurs when attempting to access files, because the system call move_mount() uses pointers declared in the inode_operations structure, which for the bdev pseudo-filesystem are always equal to 0. `inode->i_op = &empty_iops;` [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0010) - not-present page PGD 23380067 P4D 23380067 PUD 23381067 PMD 0 Oops: 0010 [#1] PREEMPT SMP KASAN NOPTI CPU: 2 PID: 17125 Comm: syz-executor.0 Not tainted 6.1.155-syzkaller-00350-g84221fde2681 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:0x0 Call Trace: <TASK> lookup_open.isra.0+0x700/0x1180 fs/namei.c:3460 open_last_lookups fs/namei.c:3550 [inline] path_openat+0x953/0x2700 fs/namei.c:3780 do_filp_open+0x1c5/0x410 fs/namei.c:3810 do_sys_openat2+0x171/0x4d0 fs/open.c:1318 do_sys_open fs/open.c:1334 [inline] __do_sys_openat fs/open.c:1350 [inline] __se_sys_openat fs/open.c:1345 [inline] __x64_sys_openat+0x13c/0x1f0 fs/open.c:1345 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Title		block: Avoid mounting the bdev pseudo-filesystem in userspace
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/197971e6ffc0a6356b2ba2b22beb42bc0f7e412d https://git.kernel.org/stable/c/3804e6de30ae7b053d53341d9d6944356cf23b40 https://git.kernel.org/stable/c/717f721eb67d2dacd3ed5f7495aef2f442e84ce4 https://git.kernel.org/stable/c/f73aa66dffcb8e61e78f01b56163ec16a15d06d2

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T12:02:12.484Z

Updated: 2026-07-24T14:34:07.309Z

Reserved: 2026-07-19T07:54:57.013Z

Link: CVE-2026-63810

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Low

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63810 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T22:30:06Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object