CVE-2026-63864

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63864", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.017Z", "datePublished": "2026-07-19T14:04:50.605Z", "dateUpdated": "2026-08-05T12:36:40.261Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:36:40.261Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Propagate error from visit_tailcall_insn\n\nCommit e40f5a6bf88a (\"bpf: correct stack liveness for tail calls\") added\nvisit_tailcall_insn() but did not check its return value."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only through the bpf() syscall during BPF_PROG_LOAD verification (check_cfg/visit_insn), which is a local kernel interface per kernel CVSS guidance for BPF.\nAC:L - An attacker can craft a BPF program using tail calls and subprograms to hit visit_tailcall_insn(), and can pressure kernel memory (parallel BPF loads/maps) to make the small jt allocation fail while verification continues.\nPR:N - Exploitation occurs at BPF_PROG_LOAD time via bpf(); on systems with kernel.unprivileged_bpf_disabled=0, unprivileged users can load socket-filter programs with PROG_ARRAY maps and tail calls without CAP_BPF or root.\nUI:N - No victim interaction is required; the attacker triggers the flaw by loading a malicious BPF program through their own bpf() syscall.\nS:U - Impact is a BPF verifier bypass leading to kernel memory corruption and local privilege escalation within the same kernel security boundary, not a cross-authority escape such as VM guest-to-host.\nC:H - Incorrect tail-call stack liveness lets verifier-approved programs perform out-of-bounds stack reads at runtime, exposing adjacent kernel stack memory and enabling arbitrary kernel memory disclosure primitives.\nI:H - The verifier bypass permits out-of-bounds stack writes and type confusion on stack slots, which can be leveraged for control-flow hijacking and arbitrary kernel code execution from BPF context.\nA:H - Out-of-bounds BPF stack access can trigger kernel oops/panic during program execution, and repeated exploitation can be used for denial of service even when full exploitation is not attempted."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/verifier.c"], "versions": [{"version": "e40f5a6bf88a781d5f81bc6b8aab9ac31d8c98dd", "lessThan": "945816e63c8677cf4bfde963a0774432ce8afc85", "status": "affected", "versionType": "git"}, {"version": "e40f5a6bf88a781d5f81bc6b8aab9ac31d8c98dd", "lessThan": "6bd96e40f31dde8f8cd79772b4df0f171cf8a915", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/verifier.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/945816e63c8677cf4bfde963a0774432ce8afc85"}, {"url": "https://git.kernel.org/stable/c/6bd96e40f31dde8f8cd79772b4df0f171cf8a915"}], "title": "bpf: Propagate error from visit_tailcall_insn", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/verifier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "945816e63c8677cf4bfde963a0774432ce8afc85", "status": "affected", "version": "e40f5a6bf88a781d5f81bc6b8aab9ac31d8c98dd", "versionType": "git"}, {"lessThan": "6bd96e40f31dde8f8cd79772b4df0f171cf8a915", "status": "affected", "version": "e40f5a6bf88a781d5f81bc6b8aab9ac31d8c98dd", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/bpf/verifier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A13475D2-59BF-4716-94B5-7C1D239A2CF4", "versionEndExcluding": "7.0.10", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Propagate error from visit_tailcall_insn\n\nCommit e40f5a6bf88a (\"bpf: correct stack liveness for tail calls\") added\nvisit_tailcall_insn() but did not check its return value."}], "id": "CVE-2026-63864", "lastModified": "2026-10-26T16:55:46.360", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-19T15:16:53.303", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6bd96e40f31dde8f8cd79772b4df0f171cf8a915"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/945816e63c8677cf4bfde963a0774432ce8afc85"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: bpf: Propagate error from visit_tailcall_insn", "id": "2502284", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502284"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-252", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Propagate error from visit_tailcall_insn\nCommit e40f5a6bf88a (\"bpf: correct stack liveness for tail calls\") added\nvisit_tailcall_insn() but did not check its return value.", "A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier. The `visit_tailcall_insn` function, which is part of the BPF program validation process, failed to check and propagate error return values. This oversight could lead to an unhandled error condition within the kernel, potentially affecting system stability or integrity. The vulnerability stems from a missing error check, which is a fundamental security mechanism."], "name": "CVE-2026-63864", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63864\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63864\nhttps://lore.kernel.org/linux-cve-announce/2026071934-CVE-2026-63864-e441@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e40f5a6bf88a781d5f81bc6b8aab9ac31d8c98dd,945816e63c8677cf4bfde963a0774432ce8afc85)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e40f5a6bf88a781d5f81bc6b8aab9ac31d8c98dd,6bd96e40f31dde8f8cd79772b4df0f171cf8a915)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.10,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T03:15:02.662470+00:00", "updated": "2026-10-26T18:45:14.279337+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}