CVE-2026-63809

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: bpf: use kvfree() for replaced sysctl write buffer proc_sys_call_handler() allocates its temporary sysctl buffer with kvzalloc() and passes it to __cgroup_bpf_run_filter_sysctl(). Since kvzalloc() may fall back to vmalloc() for large allocations, freeing that buffer with kfree() is wrong and can corrupt memory. Use kvfree() to safely handle both kmalloc and kvzalloc()/vmalloc allocations. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1....

Affected product and versions

Product

Linux

Affected versions

>= b7925acd82926ebbf94a0f0783a3961f4e558856 < d0a81ed5ff5d0f9c3f63a4f9e5a4642c363ecd3e, >= 4508943794efdd94171549c0bd52810e2f4ad9fe < 77355ef7a9f6b0d2bdf65be3b37f2c1f365e20d2, >= 4508943794efdd94171549c0bd52810e2f4ad9fe < e1d1e203a6000804c5d3b8a4aa4e52303c0c7ab2, >= 4508943794efdd94171549c0bd52810e2f4ad9fe < 81fc9a13acae99966232f0e055eb2e445263b89a, >= 4508943794efdd94171549c0bd52810e2f4ad9fe < 838fe9c28121777c59a9406710a68fcf77bb8017, >= 4508943794efdd94171549c0bd52810e2f4ad9fe < 65bd0c0afb0e1bf3287458e342429b069624f7d4, >= 4508943794efdd94171549c0bd52810e2f4ad9fe < 70df4de46577fab5e25418f014583155a147c902, >= 4508943794efdd94171549c0bd52810e2f4ad9fe < 4c21b5927d4364bfe7365f2700da5fea0ed0d004, >= 66258ab303588936ee1ee0794d9a271be24f73cb, >= 5.10.20 < 5.10.260, >= 5.11.3 < 5.12, >= 5.12

Fixed versions

No verified fixed-version field is available yet

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

Not available