CVE-2026-63981 Linux CVE debrief

Who should care

System administrators and users of Linux kernel versions that are vulnerable to this exploit should apply patches or mitigations to prevent potential stack overflow attacks. This vulnerability could be exploited by an unprivileged user via user namespaces, making it a high-priority vulnerability to address.

Technical summary

The act_mirred function in the Linux kernel did not properly increment a recursion counter before calling tcf_blockcast, allowing for an unbounded recursion loop and potential stack overflow. This vulnerability can be exploited by an unprivileged user via user namespaces. The vulnerability was reachable from an unprivileged user via unshare(CLONE_NEWUSER | CLONE_NEWNET): user namespaces grant CAP_NET_ADMIN in the new network namespace, which is sufficient to create dummy devices, attach clsact qdiscs with shared blocks, and install mirred blockcast filters.

Defensive priority

High

Recommended defensive actions

• Apply patches or updates to the Linux kernel to fix the vulnerability
• Implement compensating controls to limit the impact of potential exploits
• Monitor system logs for signs of exploitation attempts
• Review and update incident response plans to include procedures for addressing potential stack overflow attacks
• Conduct regular vulnerability assessments to identify and address potential vulnerabilities in the Linux kernel
• Verify that all necessary security patches are applied and up-to-date
• Consider implementing additional security controls, such as network segmentation or access controls, to limit the impact of potential exploits

Evidence notes

The CVE record was published on 2026-07-19T16:17:17.283Z and has not been modified since then. The NVD entry is currently Received. There is no additional information available about the vulnerability beyond what is provided in the CVE record and NVD entry.

Official resources