Use-after-free in Linux kernel - CVE-2026-63894

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU138761

Use-after-free in Linux kernel - CVE-2026-63894

Published: July 20, 2026


Vulnerability identifier: #VU138761
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-63894
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local privileged user to cause a denial of service.

The vulnerability exists due to a use-after-free in the FunctionFS DMABUF cancel and release paths when handling a concurrent request completion and detach or close operation. A local privileged user can trigger a DMABUF detach ioctl or close the FunctionFS device during request completion to cause a denial of service.

The issue is reachable from the FunctionFS device node and is not reachable from an attached USB host on the cable. Deployments may delegate the device node to a non-root gadget service.


Affected software

Linux kernel
Ubuntu
linux-ibm (Ubuntu package)
linux-azure (Ubuntu package)
linux-aws (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-nvidia-bos (Ubuntu package)

How to mitigate CVE-2026-63894

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-ibm (Ubuntu package) - addressed in versions 7.0.0-1008.8, 7.0.0-1010.10
linux-azure (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1010.10
linux-aws (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1015.15
linux-nvidia (Ubuntu package) - addressed in versions 7.0.0-1016.16, 7.0.0-1016.16~24.04.1
linux-nvidia-bos (Ubuntu package) - update to 7.0.0-2016.16

External References

Related Security Bulletins