Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-63808— exfat: fix potential use-after-free in exfat_find_dir_entry()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 5.7版本存在安全漏洞，该漏洞源于exfat文件系统中的exfat_find_dir_entry()函数存在释放后重用问题，可能导致攻击者利用特制的exFAT镜像触发释放后重用，进而导致系统崩溃。

CVSS 9.8 · Critical EPSS 0.53% · P43

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux ca06197382bde0a3bc20215595d1c9ce20c6e341< e6f1a11cfb808441a43ffae9b476cc135732cd27 affected
ca06197382bde0a3bc20215595d1c9ce20c6e341< e48f413c2815787b8cade2795e194e3c4cd782ef affected
ca06197382bde0a3bc20215595d1c9ce20c6e341< 06c4e1e9967d332ac33ba38b7819851089ff9359 affected
ca06197382bde0a3bc20215595d1c9ce20c6e341< 8e0abc17fbd7e305802e84fe98b4950d50f9c433 affected
ca06197382bde0a3bc20215595d1c9ce20c6e341< 4d101016d5e587f820b3ae2d5bb6770d86342649 affected
ca06197382bde0a3bc20215595d1c9ce20c6e341< adfacfbaeae2cb760f492357cc36b41f84ef7f86 affected
ca06197382bde0a3bc20215595d1c9ce20c6e341< 708b97e792945d3e4653939fd3405d71a61ad065 affected
ca06197382bde0a3bc20215595d1c9ce20c6e341< 3f5f8ee9917cc2b9076ac533492d8a200edcabb8 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63808

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
exfat: fix potential use-after-free in exfat_find_dir_entry()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: exfat: fix potential use-after-free in exfat_find_dir_entry() In exfat_find_dir_entry(), the buffer_head obtained from exfat_get_dentry() is released with brelse(bh) before the fall-through TYPE_EXTEND branch reads the directory entry through ep (which points into bh->b_data): brelse(bh); if (entry_type == TYPE_EXTEND) { ... len = exfat_extract_uni_name(ep, entry_uniname); ... } After brelse() drops our reference, nothing guarantees that the underlying page backing bh->b_data remains valid for the subsequent exfat_extract_uni_name() read. This is the same pattern fixed in commit fc961522ddbd ("exfat: Fix potential use after free in exfat_load_upcase_table()"). Move brelse(bh) so it runs after ep is no longer dereferenced on each branch. Confirmed on QEMU x86_64 with CONFIG_KASAN=y + CONFIG_DEBUG_PAGEALLOC=y + CONFIG_PAGE_POISONING=y on linux-next, using a crafted exFAT image (long filename with same-hash collisions forcing the TYPE_EXTEND path). With a debug-only invalidate_bdev() inserted between brelse(bh) and the ep read to make the stale-deref window deterministic, the unpatched kernel faults: BUG: KASAN: use-after-free in exfat_find_dir_entry+0x133b/0x15a0 BUG: unable to handle page fault for address: ffff88801a5fa0c2 Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI RIP: 0010:exfat_find_dir_entry+0x1188/0x15a0 With this patch applied, the same instrumented harness completes cleanly under the same sanitizer stack. I have not reproduced a crash on an uninstrumented kernel under ordinary reclaim; the instrumented A/B establishes the lifetime violation and that the patch closes it, not an unaided triggerability claim.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 5.7版本存在安全漏洞，该漏洞源于exfat文件系统中的exfat_find_dir_entry()函数存在释放后重用问题，可能导致攻击者利用特制的exFAT镜像触发释放后重用，进而导致系统崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux ca06197382bde0a3bc20215595d1c9ce20c6e341 ~ e6f1a11cfb808441a43ffae9b476cc135732cd27 -
Linux Linux 5.7 -

II. Public POCs for CVE-2026-63808

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63808

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-63808 (6)

Other References for CVE-2026-63808 (1)

Same Patch Batch · Linux · 2026-07-19 · 429 CVEs total

CVE-2026-63795 10.0 CRITICAL 9p: avoid putting oldfid in p9_client_walk() error path
CVE-2026-64033 9.8 CRITICAL RDMA/rtrs: Fix use-after-free in path file creation cleanup
CVE-2026-64142 9.8 CRITICAL ksmbd: close durable scavenger races against m_fp_list lookups
CVE-2026-64125 9.8 CRITICAL net: bcmgenet: keep RBUF EEE/PM disabled
CVE-2026-63924 9.8 CRITICAL ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
CVE-2026-63857 9.8 CRITICAL net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()
CVE-2026-53399 9.8 CRITICAL nfsd: release layout stid on setlease failure
CVE-2026-53398 9.8 CRITICAL NFSD: Fix SECINFO_NO_NAME decode error cleanup
CVE-2026-63984 9.8 CRITICAL ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
CVE-2026-64047 9.8 CRITICAL net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring
CVE-2026-64025 9.8 CRITICAL bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
CVE-2026-63886 9.8 CRITICAL scsi: target: iscsi: Validate CHAP_R length before base64 decode
CVE-2026-63979 9.8 CRITICAL net/handshake: hand off the pinned file reference to accept_doit
CVE-2026-64150 9.8 CRITICAL netfilter: nft_inner: release local_lock before re-enabling softirqs
CVE-2026-64055 9.8 CRITICAL net: ethernet: cortina: Carry over frag counter
CVE-2026-63887 9.8 CRITICAL scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf
CVE-2026-64162 9.8 CRITICAL idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init()
CVE-2026-63922 9.8 CRITICAL ipv6: exthdrs: refresh nh after handling HAO option
CVE-2026-64035 9.8 CRITICAL igc: set tx buffer type for SMD frames
CVE-2026-63888 9.8 CRITICAL scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd()

Showing top 20 of 429 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-63808

No comments yet

Leave a comment