Use-after-free in Linux kernel - CVE-2026-63831

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU138822

Use-after-free in Linux kernel - CVE-2026-63831

Published: July 20, 2026


Vulnerability identifier: #VU138822
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-63831
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to cause a denial of service or corrupt data.

The vulnerability exists due to use-after-free in the mac802154 llsec crypto processing in net/mac802154/llsec.c when performing in-place cryptographic transformations on shared skb data. A local user can trigger concurrent 802.15.4 traffic with security enabled to cause a denial of service or corrupt data.

The issue can affect both RX and TX paths when skb data buffers are shared across clones.


Affected software

Linux kernel
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Ubuntu
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
linux (Ubuntu package)
linux-kvm (Ubuntu package)
linux-gcp (Ubuntu package)
linux-aws (Ubuntu package)
linux-azure (Ubuntu package)
linux-oracle (Ubuntu package)
linux-lowlatency (Ubuntu package)
linux-gke (Ubuntu package)
linux-aws-5.15 (Ubuntu package)
linux-lowlatency-hwe-5.15 (Ubuntu package)
linux-hwe-5.15 (Ubuntu package)
linux-fips (Ubuntu package)
linux-azure-5.15 (Ubuntu package)
linux-gkeop (Ubuntu package)
linux-intel-iotg (Ubuntu package)
linux-azure-fde-5.15 (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-ibm-5.15 (Ubuntu package)
linux-nvidia-tegra-igx (Ubuntu package)
linux-nvidia-tegra (Ubuntu package)
linux-realtime (Ubuntu package)
linux-ibm (Ubuntu package)
linux-intel-iotg-5.15 (Ubuntu package)
linux-oracle-5.15 (Ubuntu package)
linux-gcp-5.15 (Ubuntu package)
linux-nvidia-tegra-5.15 (Ubuntu package)
linux-xilinx-zynqmp (Ubuntu package)
linux-intel-iot-realtime (Ubuntu package)
linux-gcp-fips (Ubuntu package)
linux-aws-fips (Ubuntu package)
linux-azure-fips (Ubuntu package)
linux-azure-fde (Ubuntu package)
linux-raspi (Ubuntu package)
linux-nvidia-bos (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
linux-oracle-7.0 (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-aws-7.0 (Ubuntu package)
linux-nvidia-7.0 (Ubuntu package)
kernel (Red Hat package)
kernel-rt (Red Hat package)
kernel-zfcpdump-devel (Red Hat package)
kernel-64k-devel-matched (Red Hat package)
kernel-64k-devel (Red Hat package)
kernel-64k-debug-devel-matched (Red Hat package)
kernel-64k-debug-devel (Red Hat package)
kernel-zfcpdump-devel-matched (Red Hat package)
python3-perf (Red Hat package)
perf (Red Hat package)
kernel-headers (Red Hat package)
kernel-devel-matched (Red Hat package)
kernel-devel (Red Hat package)
kernel-debug-devel-matched (Red Hat package)
kernel-debug-devel (Red Hat package)

How to mitigate CVE-2026-63831

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - addressed in versions 5.15.0-198.208, 6.8.0-147.147, 7.0.0-31.31
linux-kvm (Ubuntu package) - update to 5.15.0-1109.114
linux-gcp (Ubuntu package) - addressed in versions 5.15.0-1118.128, 6.8.0-1071.79, 7.0.0-1011.11
linux-aws (Ubuntu package) - addressed in versions 5.15.0-1117.124, 6.8.0-1067.70, 7.0.0-1012.12
linux-azure (Ubuntu package) - addressed in versions 5.15.0-1123.132, 6.8.0-1071.79, 7.0.0-1014.14
linux-oracle (Ubuntu package) - addressed in versions 5.15.0-1114.120, 6.8.0-1064.67, 7.0.0-1011.11
linux-lowlatency (Ubuntu package) - addressed in versions 5.15.0-195.205, 6.8.0-147.147.1
linux-gke (Ubuntu package) - addressed in versions 5.15.0-1113.119, 6.8.0-1066.74, 7.0.0-1006.7
linux-aws-5.15 (Ubuntu package) - update to 5.15.0-1117.124~20.04.1
linux-lowlatency-hwe-5.15 (Ubuntu package) - update to 5.15.0-195.205~20.04.1
linux-hwe-5.15 (Ubuntu package) - update to 5.15.0-198.208~20.04.1
linux-fips (Ubuntu package) - addressed in versions 5.15.0-198.208+fips1, 6.8.0-147.147+fips1
linux-azure-5.15 (Ubuntu package) - update to 5.15.0-1123.132~20.04.1
linux-gkeop (Ubuntu package) - addressed in versions 5.15.0-1100.108, 6.8.0-1052.56
linux-intel-iotg (Ubuntu package) - update to 5.15.0-1112.118
linux-azure-fde-5.15 (Ubuntu package) - update to 5.15.0-1122.131~20.04.1
linux-nvidia (Ubuntu package) - addressed in versions 5.15.0-1112.113, 7.0.0-1018.18
linux-ibm-5.15 (Ubuntu package) - update to 5.15.0-1111.115~20.04.1
linux-nvidia-tegra-igx (Ubuntu package) - update to 5.15.0-1059.59
linux-nvidia-tegra (Ubuntu package) - addressed in versions 5.15.0-1070.72, 6.8.0-1035.38
linux-realtime (Ubuntu package) - addressed in versions 5.15.0-1116.125, 6.8.1-1062.63, 7.0.0-31.31.1
linux-ibm (Ubuntu package) - addressed in versions 5.15.0-1111.115, 6.8.0-1067.68, 7.0.0-1013.13
linux-intel-iotg-5.15 (Ubuntu package) - update to 5.15.0-1112.118~20.04.1
linux-oracle-5.15 (Ubuntu package) - update to 5.15.0-1114.120~20.04.1
linux-gcp-5.15 (Ubuntu package) - update to 5.15.0-1118.128~20.04.1
linux-nvidia-tegra-5.15 (Ubuntu package) - update to 5.15.0-1070.72~20.04.1
linux-xilinx-zynqmp (Ubuntu package) - update to 5.15.0-1080.84
linux-intel-iot-realtime (Ubuntu package) - update to 5.15.0-1109.111
linux-gcp-fips (Ubuntu package) - addressed in versions 5.15.0-1118.128+fips1, 6.8.0-1071.79+fips1
linux-aws-fips (Ubuntu package) - addressed in versions 5.15.0-1117.124+fips1, 6.8.0-1067.70+fips1
linux-azure-fips (Ubuntu package) - addressed in versions 5.15.0-1123.132+fips1, 6.8.0-1071.79+fips1
linux-azure-fde (Ubuntu package) - update to 6.8.0-1069.76
linux-raspi (Ubuntu package) - update to 7.0.0-1019.19
linux-nvidia-bos (Ubuntu package) - update to 7.0.0-2018.18
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-31.31~24.04.1
linux-azure-7.0 (Ubuntu package) - update to 7.0.0-1014.14~24.04.1
linux-oracle-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1013.13
linux-aws-7.0 (Ubuntu package) - update to 7.0.0-1012.12~24.04.1
linux-nvidia-7.0 (Ubuntu package) - update to 7.0.0-1018.18~24.04.1
kernel (Red Hat package) - addressed in versions 4.18.0-305.216.1.el8_4, 4.18.0-372.225.1.el8_6, 4.18.0-477.177.1.el8_8, 4.18.0-553.167.1.el8_10, 5.14.0-284.200.1.el9_2, 5.14.0-687.51.1.el9_8, 6.12.0-55.113.1.el10_0
kernel-rt (Red Hat package) - addressed in versions 4.18.0-553.167.1.rt7.508.el8_10, 5.14.0-284.200.1.rt14.485.el9_2
kernel-zfcpdump-devel (Red Hat package) - update to 6.12.0-211.59.1.el10_2
kernel-64k-devel-matched (Red Hat package) - update to 6.12.0-211.59.1.el10_2
kernel-64k-devel (Red Hat package) - update to 6.12.0-211.59.1.el10_2
kernel-64k-debug-devel-matched (Red Hat package) - update to 6.12.0-211.59.1.el10_2
kernel-64k-debug-devel (Red Hat package) - update to 6.12.0-211.59.1.el10_2
kernel-zfcpdump-devel-matched (Red Hat package) - update to 6.12.0-211.59.1.el10_2
python3-perf (Red Hat package) - update to 6.12.0-211.59.1.el10_2
perf (Red Hat package) - update to 6.12.0-211.59.1.el10_2
kernel-headers (Red Hat package) - update to 6.12.0-211.59.1.el10_2
kernel-devel-matched (Red Hat package) - update to 6.12.0-211.59.1.el10_2
kernel-devel (Red Hat package) - update to 6.12.0-211.59.1.el10_2
kernel-debug-devel-matched (Red Hat package) - update to 6.12.0-211.59.1.el10_2
kernel-debug-devel (Red Hat package) - update to 6.12.0-211.59.1.el10_2

External References

Related Security Bulletins