{"api_version":"1","generated_at":"2026-07-23T11:58:40+00:00","cve":"CVE-2026-63808","urls":{"html":"https://cve.report/CVE-2026-63808","api":"https://cve.report/api/cve/CVE-2026-63808.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-63808","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-63808"},"summary":{"title":"exfat: fix potential use-after-free in exfat_find_dir_entry()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: fix potential use-after-free in exfat_find_dir_entry()\n\nIn exfat_find_dir_entry(), the buffer_head obtained from\nexfat_get_dentry() is released with brelse(bh) before the fall-through\nTYPE_EXTEND branch reads the directory entry through ep (which points\ninto bh->b_data):\n\n\tbrelse(bh);\n\tif (entry_type == TYPE_EXTEND) {\n\t\t...\n\t\tlen = exfat_extract_uni_name(ep, entry_uniname);\n\t\t...\n\t}\n\nAfter brelse() drops our reference, nothing guarantees that the\nunderlying page backing bh->b_data remains valid for the subsequent\nexfat_extract_uni_name() read. This is the same pattern fixed in\ncommit fc961522ddbd (\"exfat: Fix potential use after free in\nexfat_load_upcase_table()\").\n\nMove brelse(bh) so it runs after ep is no longer dereferenced on\neach branch.\n\nConfirmed on QEMU x86_64 with CONFIG_KASAN=y + CONFIG_DEBUG_PAGEALLOC=y\n+ CONFIG_PAGE_POISONING=y on linux-next, using a crafted exFAT image\n(long filename with same-hash collisions forcing the TYPE_EXTEND path).\nWith a debug-only invalidate_bdev() inserted between brelse(bh) and\nthe ep read to make the stale-deref window deterministic, the\nunpatched kernel faults:\n\n  BUG: KASAN: use-after-free in exfat_find_dir_entry+0x133b/0x15a0\n  BUG: unable to handle page fault for address: ffff88801a5fa0c2\n  Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI\n  RIP: 0010:exfat_find_dir_entry+0x1188/0x15a0\n\nWith this patch applied, the same instrumented harness completes\ncleanly under the same sanitizer stack. I have not reproduced a\ncrash on an uninstrumented kernel under ordinary reclaim; the\ninstrumented A/B establishes the lifetime violation and that the\npatch closes it, not an unaided triggerability claim.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-07-19 12:16:53","updated_at":"2026-07-20 15:16:47"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/8e0abc17fbd7e305802e84fe98b4950d50f9c433","name":"https://git.kernel.org/stable/c/8e0abc17fbd7e305802e84fe98b4950d50f9c433","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/06c4e1e9967d332ac33ba38b7819851089ff9359","name":"https://git.kernel.org/stable/c/06c4e1e9967d332ac33ba38b7819851089ff9359","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e48f413c2815787b8cade2795e194e3c4cd782ef","name":"https://git.kernel.org/stable/c/e48f413c2815787b8cade2795e194e3c4cd782ef","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/708b97e792945d3e4653939fd3405d71a61ad065","name":"https://git.kernel.org/stable/c/708b97e792945d3e4653939fd3405d71a61ad065","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/adfacfbaeae2cb760f492357cc36b41f84ef7f86","name":"https://git.kernel.org/stable/c/adfacfbaeae2cb760f492357cc36b41f84ef7f86","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e6f1a11cfb808441a43ffae9b476cc135732cd27","name":"https://git.kernel.org/stable/c/e6f1a11cfb808441a43ffae9b476cc135732cd27","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3f5f8ee9917cc2b9076ac533492d8a200edcabb8","name":"https://git.kernel.org/stable/c/3f5f8ee9917cc2b9076ac533492d8a200edcabb8","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/4d101016d5e587f820b3ae2d5bb6770d86342649","name":"https://git.kernel.org/stable/c/4d101016d5e587f820b3ae2d5bb6770d86342649","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63808","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63808","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ca06197382bde0a3bc20215595d1c9ce20c6e341 e6f1a11cfb808441a43ffae9b476cc135732cd27 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ca06197382bde0a3bc20215595d1c9ce20c6e341 e48f413c2815787b8cade2795e194e3c4cd782ef git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ca06197382bde0a3bc20215595d1c9ce20c6e341 06c4e1e9967d332ac33ba38b7819851089ff9359 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ca06197382bde0a3bc20215595d1c9ce20c6e341 8e0abc17fbd7e305802e84fe98b4950d50f9c433 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ca06197382bde0a3bc20215595d1c9ce20c6e341 4d101016d5e587f820b3ae2d5bb6770d86342649 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ca06197382bde0a3bc20215595d1c9ce20c6e341 adfacfbaeae2cb760f492357cc36b41f84ef7f86 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ca06197382bde0a3bc20215595d1c9ce20c6e341 708b97e792945d3e4653939fd3405d71a61ad065 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ca06197382bde0a3bc20215595d1c9ce20c6e341 3f5f8ee9917cc2b9076ac533492d8a200edcabb8 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.7","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.7 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.260 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.211 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.177 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.144 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.95 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.38 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.3 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"63808","cve":"CVE-2026-63808","epss":"0.001770000","percentile":"0.074180000","score_date":"2026-07-20","updated_at":"2026-07-21 00:13:14"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/exfat/dir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e6f1a11cfb808441a43ffae9b476cc135732cd27","status":"affected","version":"ca06197382bde0a3bc20215595d1c9ce20c6e341","versionType":"git"},{"lessThan":"e48f413c2815787b8cade2795e194e3c4cd782ef","status":"affected","version":"ca06197382bde0a3bc20215595d1c9ce20c6e341","versionType":"git"},{"lessThan":"06c4e1e9967d332ac33ba38b7819851089ff9359","status":"affected","version":"ca06197382bde0a3bc20215595d1c9ce20c6e341","versionType":"git"},{"lessThan":"8e0abc17fbd7e305802e84fe98b4950d50f9c433","status":"affected","version":"ca06197382bde0a3bc20215595d1c9ce20c6e341","versionType":"git"},{"lessThan":"4d101016d5e587f820b3ae2d5bb6770d86342649","status":"affected","version":"ca06197382bde0a3bc20215595d1c9ce20c6e341","versionType":"git"},{"lessThan":"adfacfbaeae2cb760f492357cc36b41f84ef7f86","status":"affected","version":"ca06197382bde0a3bc20215595d1c9ce20c6e341","versionType":"git"},{"lessThan":"708b97e792945d3e4653939fd3405d71a61ad065","status":"affected","version":"ca06197382bde0a3bc20215595d1c9ce20c6e341","versionType":"git"},{"lessThan":"3f5f8ee9917cc2b9076ac533492d8a200edcabb8","status":"affected","version":"ca06197382bde0a3bc20215595d1c9ce20c6e341","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/exfat/dir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.7"},{"lessThan":"5.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.260","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.211","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.177","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.144","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.95","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.38","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.260","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.211","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.177","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.144","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.95","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.38","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.3","versionStartIncluding":"5.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2-rc1","versionStartIncluding":"5.7","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: fix potential use-after-free in exfat_find_dir_entry()\n\nIn exfat_find_dir_entry(), the buffer_head obtained from\nexfat_get_dentry() is released with brelse(bh) before the fall-through\nTYPE_EXTEND branch reads the directory entry through ep (which points\ninto bh->b_data):\n\n\tbrelse(bh);\n\tif (entry_type == TYPE_EXTEND) {\n\t\t...\n\t\tlen = exfat_extract_uni_name(ep, entry_uniname);\n\t\t...\n\t}\n\nAfter brelse() drops our reference, nothing guarantees that the\nunderlying page backing bh->b_data remains valid for the subsequent\nexfat_extract_uni_name() read. This is the same pattern fixed in\ncommit fc961522ddbd (\"exfat: Fix potential use after free in\nexfat_load_upcase_table()\").\n\nMove brelse(bh) so it runs after ep is no longer dereferenced on\neach branch.\n\nConfirmed on QEMU x86_64 with CONFIG_KASAN=y + CONFIG_DEBUG_PAGEALLOC=y\n+ CONFIG_PAGE_POISONING=y on linux-next, using a crafted exFAT image\n(long filename with same-hash collisions forcing the TYPE_EXTEND path).\nWith a debug-only invalidate_bdev() inserted between brelse(bh) and\nthe ep read to make the stale-deref window deterministic, the\nunpatched kernel faults:\n\n  BUG: KASAN: use-after-free in exfat_find_dir_entry+0x133b/0x15a0\n  BUG: unable to handle page fault for address: ffff88801a5fa0c2\n  Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI\n  RIP: 0010:exfat_find_dir_entry+0x1188/0x15a0\n\nWith this patch applied, the same instrumented harness completes\ncleanly under the same sanitizer stack. I have not reproduced a\ncrash on an uninstrumented kernel under ordinary reclaim; the\ninstrumented A/B establishes the lifetime violation and that the\npatch closes it, not an unaided triggerability claim."}],"metrics":[{"cvssV3_1":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"providerMetadata":{"dateUpdated":"2026-07-20T13:40:17.638Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/e6f1a11cfb808441a43ffae9b476cc135732cd27"},{"url":"https://git.kernel.org/stable/c/e48f413c2815787b8cade2795e194e3c4cd782ef"},{"url":"https://git.kernel.org/stable/c/06c4e1e9967d332ac33ba38b7819851089ff9359"},{"url":"https://git.kernel.org/stable/c/8e0abc17fbd7e305802e84fe98b4950d50f9c433"},{"url":"https://git.kernel.org/stable/c/4d101016d5e587f820b3ae2d5bb6770d86342649"},{"url":"https://git.kernel.org/stable/c/adfacfbaeae2cb760f492357cc36b41f84ef7f86"},{"url":"https://git.kernel.org/stable/c/708b97e792945d3e4653939fd3405d71a61ad065"},{"url":"https://git.kernel.org/stable/c/3f5f8ee9917cc2b9076ac533492d8a200edcabb8"}],"title":"exfat: fix potential use-after-free in exfat_find_dir_entry()","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-63808","datePublished":"2026-07-19T12:02:11.323Z","dateReserved":"2026-07-19T07:54:57.013Z","dateUpdated":"2026-07-20T13:40:17.638Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-07-19 12:16:53","lastModifiedDate":"2026-07-20 15:16:47","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"63808","Ordinal":"1","Title":"exfat: fix potential use-after-free in exfat_find_dir_entry()","CVE":"CVE-2026-63808","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"63808","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: fix potential use-after-free in exfat_find_dir_entry()\n\nIn exfat_find_dir_entry(), the buffer_head obtained from\nexfat_get_dentry() is released with brelse(bh) before the fall-through\nTYPE_EXTEND branch reads the directory entry through ep (which points\ninto bh->b_data):\n\n\tbrelse(bh);\n\tif (entry_type == TYPE_EXTEND) {\n\t\t...\n\t\tlen = exfat_extract_uni_name(ep, entry_uniname);\n\t\t...\n\t}\n\nAfter brelse() drops our reference, nothing guarantees that the\nunderlying page backing bh->b_data remains valid for the subsequent\nexfat_extract_uni_name() read. This is the same pattern fixed in\ncommit fc961522ddbd (\"exfat: Fix potential use after free in\nexfat_load_upcase_table()\").\n\nMove brelse(bh) so it runs after ep is no longer dereferenced on\neach branch.\n\nConfirmed on QEMU x86_64 with CONFIG_KASAN=y + CONFIG_DEBUG_PAGEALLOC=y\n+ CONFIG_PAGE_POISONING=y on linux-next, using a crafted exFAT image\n(long filename with same-hash collisions forcing the TYPE_EXTEND path).\nWith a debug-only invalidate_bdev() inserted between brelse(bh) and\nthe ep read to make the stale-deref window deterministic, the\nunpatched kernel faults:\n\n  BUG: KASAN: use-after-free in exfat_find_dir_entry+0x133b/0x15a0\n  BUG: unable to handle page fault for address: ffff88801a5fa0c2\n  Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI\n  RIP: 0010:exfat_find_dir_entry+0x1188/0x15a0\n\nWith this patch applied, the same instrumented harness completes\ncleanly under the same sanitizer stack. I have not reproduced a\ncrash on an uninstrumented kernel under ordinary reclaim; the\ninstrumented A/B establishes the lifetime violation and that the\npatch closes it, not an unaided triggerability claim.","Type":"Description","Title":"exfat: fix potential use-after-free in exfat_find_dir_entry()"}]}}}