CVE-2026-63808
A critical use-after-free flaw exists in the Linux kernel's exfat filesystem when handling directory entries with long filenames. The flaw can be triggered by a crafted exFAT image, potentially leading to a crash or other undefined behavior. The issue has been resolved by moving a buffer release call after the directory entry is no longer accessed.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux systems using the exfat driver.
Real-world impact
An attacker could cause a denial of service or possibly execute code by mounting a malicious exFAT volume.
Why this severity
CVSS v3.1 base score 9.8 (Critical) due to network‑adjacent, low‑complexity attack requiring no privileges or user interaction, with high impact on confidentiality, integrity, and availability.
What to do about it
- 01Update the Linux kernel to a version that includes the patch fixing the use‑after‑free in exfat_find_dir_entry() (the fix moves the brelse(bh) call after the ep dereference).
NVD‑referenced kernel patch
Timeline
- Jul 19, 2026 · 14d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 13d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 27, 2026 · 6d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/06c4e1e9967d332ac3…
- git.kernel.org/stable/c/3f5f8ee9917cc2b907…
- git.kernel.org/stable/c/4d101016d5e587f820…
- git.kernel.org/stable/c/708b97e792945d3e46…
- git.kernel.org/stable/c/8e0abc17fbd7e30580…
- git.kernel.org/stable/c/adfacfbaeae2cb760f…
- git.kernel.org/stable/c/e48f413c2815787b8c…
- git.kernel.org/stable/c/e6f1a11cfb808441a4…