Out-of-bounds read in Linux kernel - CVE-2026-63895

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU138762

Out-of-bounds read in Linux kernel - CVE-2026-63895

Published: July 20, 2026


Vulnerability identifier: #VU138762
CSH Severity: Low
CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-63895
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local privileged user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in ffs_ep0_read() in the FunctionFS gadget implementation when handling a short ep0 control-OUT read. A local privileged user can trigger a short control-OUT transfer and read back uninitialized kernel heap memory to disclose sensitive information.

The issue is reachable through the FunctionFS device node and requires access to the privileged gadget daemon context. Reproducing the condition also requires bypassing normal host-side checks that usually reject short-wLength control-OUT requests before they reach the gadget.


Affected software

Linux kernel
Ubuntu
linux-ibm (Ubuntu package)
linux-azure (Ubuntu package)
linux-aws (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-nvidia-bos (Ubuntu package)

How to mitigate CVE-2026-63895

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-ibm (Ubuntu package) - addressed in versions 7.0.0-1008.8, 7.0.0-1010.10
linux-azure (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1010.10
linux-aws (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1015.15
linux-nvidia (Ubuntu package) - addressed in versions 7.0.0-1016.16, 7.0.0-1016.16~24.04.1
linux-nvidia-bos (Ubuntu package) - update to 7.0.0-2016.16

External References

Related Security Bulletins