CVE-2026-63809 Linux CVE debrief

Who should care

Linux kernel developers, administrators, and users who rely on the Linux kernel for their systems should be aware of this vulnerability and ensure they are using a patched version of the kernel. They should review and apply the patch to use kvfree() for replaced sysctl write buffer, ensure Linux kernel is updated to a version that includes the fix, and monitor systems for unusual behavior that could indicate exploitation.

Technical summary

The vulnerability was caused by the use of kfree() to deallocate a buffer allocated with kvzalloc() in the proc_sys_call_handler() function. This could lead to memory corruption. The fix involves replacing kfree() with kvfree() to ensure proper deallocation of the buffer, regardless of whether it was allocated with kmalloc or vmalloc. The bug was first flagged by an experimental analysis tool and manually confirmed to be present in v7.1-rc5. A reproducer was created based on v7.1-rc4 in a QEMU x86_64 guest with KASAN and CONFIG_FAILSLAB enabled.

Defensive priority

High

Recommended defensive actions

• Review and apply the patch to use kvfree() for replaced sysctl write buffer
• Ensure Linux kernel is updated to a version that includes the fix
• Monitor systems for unusual behavior that could indicate exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was first flagged by an experimental analysis tool and manually confirmed to be present in v7.1-rc5. A reproducer was created based on v7.1-rc4 in a QEMU x86_64 guest with KASAN and CONFIG_FAILSLAB enabled. The reproducer confines failslab injections to the proc_sys_call_handler() range, uses stacktrace-depth=32, and injects fail-nth=1 while writing 8191 bytes to /proc/sys/kernel/domainname from a task in the target cgroup.

Official resources