CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry()

Q: What is the severity of CVE-2026-63808?

CVE-2026-63808 has a critical severity rating of 9.8 according to the CVSS v3.1 system.

Q: What type of vulnerability is CVE-2026-63808?

CVE-2026-63808 is categorized as a 'Use After Free' vulnerability in the Linux kernel.

Q: How do I fix CVE-2026-63808?

To fix CVE-2026-63808, you should update your Linux kernel to the latest patched version provided by the Linux Kernel Project.

Q: What potential impact does CVE-2026-63808 have?

CVE-2026-63808 can lead to a denial of service or arbitrary code execution due to a use-after-free condition.

Q: In which component of the Linux kernel does CVE-2026-63808 occur?

CVE-2026-63808 occurs in the exfat filesystem implementation of the Linux kernel.

Published Jul 19, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

exfat: fix potential use-after-free in exfatfinddirentry()

In exfatfinddirentry(), the bufferhead obtained from exfatgetdentry() is released with brelse(bh) before the fall-through TYPEEXTEND branch reads the directory entry through ep (which points into bh->bdata):

brelse(bh); if (entrytype == TYPEEXTEND) { ... len = exfatextractuniname(ep, entryuniname); ... }

After brelse() drops our reference, nothing guarantees that the underlying page backing bh->bdata remains valid for the subsequent exfatextractuniname() read. This is the same pattern fixed in commit fc961522ddbd ("exfat: Fix potential use after free in exfatloadupcasetable()").

Move brelse(bh) so it runs after ep is no longer dereferenced on each branch.

Confirmed on QEMU x8664 with CONFIGKASAN=y + CONFIGDEBUGPAGEALLOC=y + CONFIGPAGEPOISONING=y on linux-next, using a crafted exFAT image (long filename with same-hash collisions forcing the TYPEEXTEND path). With a debug-only invalidatebdev() inserted between brelse(bh) and the ep read to make the stale-deref window deterministic, the unpatched kernel faults:

BUG: KASAN: use-after-free in exfatfinddirentry+0x133b/0x15a0 BUG: unable to handle page fault for address: ffff88801a5fa0c2 Oops: 0000 [#1] SMP DEBUGPAGEALLOC KASAN NOPTI RIP: 0010:exfatfinddirentry+0x1188/0x15a0

With this patch applied, the same instrumented harness completes cleanly under the same sanitizer stack. I have not reproduced a crash on an uninstrumented kernel under ordinary reclaim; the instrumented A/B establishes the lifetime violation and that the patch closes it, not an unaided triggerability claim.

Affected Software

209 affected componentsFixes available

The Linux Kernel Project Linux Kernel

Linux Linux kernel>=5.7<5.10.260

Linux Linux kernel>=5.11<5.15.211

Linux Linux kernel>=5.16<6.1.177

Linux Linux kernel>=6.2<6.6.144

Linux Linux kernel>=6.7<6.12.95

Linux Linux kernel>=6.13<6.18.38

Linux Linux kernel>=6.19<7.1.3

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15<5.15.0-1116.123~20.04.1

5.15.0-1116.123~20.04.1

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15<5.15.0-1122.131~20.04.1

5.15.0-1122.131~20.04.1

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15<5.15.0-1121.130~20.04.1

5.15.0-1121.130~20.04.1

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15<5.15.0-1118.128~20.04.1

5.15.0-1118.128~20.04.1

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15<5.15.0-194.204~20.04.1

5.15.0-194.204~20.04.1

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm-5.15<5.15.0-1110.114~20.04.1

5.15.0-1110.114~20.04.1

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15<5.15.0-1111.117~20.04.1

5.15.0-1111.117~20.04.1

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-194.204~20.04.1

5.15.0-194.204~20.04.1

ubuntu/linux-nvidia-tegra-5.15<5.15.0-1068.70~20.04.1

5.15.0-1068.70~20.04.1

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15<5.15.0-1114.120~20.04.1

5.15.0-1114.120~20.04.1

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15<5.15.0-1110.114~20.04.1

5.15.0-1110.114~20.04.1

ubuntu/linux-riscv-5.8*

ubuntu/linux<5.15.0-194.204

5.15.0-194.204

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1116.123

5.15.0-1116.123

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1069.74~22.04.1

6.8.0-1069.74~22.04.1

ubuntu/linux-azure<5.15.0-1122.131

5.15.0-1122.131

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1073.82~22.04.1

6.8.0-1073.82~22.04.1

ubuntu/linux-azure-fde<5.15.0-1121.130

5.15.0-1121.130

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8<6.8.0-1071.78~22.04.1

6.8.0-1071.78~22.04.1

ubuntu/linux-gcp<5.15.0-1117.127

5.15.0-1117.127

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1073.81~22.04.1

6.8.0-1073.81~22.04.1

ubuntu/linux-gke<5.15.0-1112.118

5.15.0-1112.118

ubuntu/linux-gkeop<5.15.0-1099.107

5.15.0-1099.107

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm<5.15.0-1110.114

5.15.0-1110.114

ubuntu/linux-ibm-6.8<6.8.0-1069.70~22.04.1

6.8.0-1069.70~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1111.117

5.15.0-1111.117

ubuntu/linux-kvm<5.15.0-1108.113

5.15.0-1108.113

ubuntu/linux-lowlatency<5.15.0-194.204

5.15.0-194.204

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-149.149.1~22.04.1

6.8.0-149.149.1~22.04.1

ubuntu/linux-nvidia<5.15.0-1111.112

5.15.0-1111.112

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8*

ubuntu/linux-nvidia-tegra<5.15.0-1068.70

5.15.0-1068.70

ubuntu/linux-nvidia-tegra-igx<5.15.0-1057.57

5.15.0-1057.57

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1113.119

5.15.0-1113.119

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1067.71~22.04.1

6.8.0-1067.71~22.04.1

ubuntu/linux-raspi<5.15.0-1110.113

5.15.0-1110.113

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp<5.15.0-1079.83

5.15.0-1079.83

ubuntu/linux-bluefield<5.15.0-1100.102

5.15.0-1100.102

ubuntu/linux-intel-iot-realtime<5.15.0-1108.110

5.15.0-1108.110

ubuntu/linux-realtime<5.15.0-1115.124

5.15.0-1115.124

ubuntu/linux-realtime-6.8<6.8.1-1064.65~22.04.1

6.8.1-1064.65~22.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips<5.15.0-1116.123+fips1

5.15.0-1116.123+fips1

ubuntu/linux-azure-fips<5.15.0-1122.131+fips1

5.15.0-1122.131+fips1

ubuntu/linux-fips<5.15.0-194.204+fips1

5.15.0-194.204+fips1

ubuntu/linux-gcp-fips<5.15.0-1116.126+fips1

5.15.0-1116.126+fips1

ubuntu/linux<6.8.0-147.147

6.8.0-147.147

ubuntu/linux-aws<6.8.0-1067.70

6.8.0-1067.70

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-aws-7.0<7.0.0-1012.12~24.04.1

7.0.0-1012.12~24.04.1

ubuntu/linux-azure<6.8.0-1071.79

6.8.0-1071.79

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17*

ubuntu/linux-azure-7.0<7.0.0-1014.14~24.04.1

7.0.0-1014.14~24.04.1

ubuntu/linux-azure-fde<6.8.0-1069.76

6.8.0-1069.76

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-fde-6.17*

ubuntu/linux-azure-fde-7.0<7.0.0-1013.13~24.04.1

7.0.0-1013.13~24.04.1

ubuntu/linux-azure-nvidia*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp<6.8.0-1071.79

6.8.0-1071.79

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-7.0<7.0.0-1011.11~24.04.1

7.0.0-1011.11~24.04.1

ubuntu/linux-gke<6.8.0-1066.74

6.8.0-1066.74

ubuntu/linux-gkeop<6.8.0-1052.56

6.8.0-1052.56

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17*

ubuntu/linux-hwe-7.0<7.0.0-31.31~24.04.1

7.0.0-31.31~24.04.1

ubuntu/linux-ibm<6.8.0-1067.68

6.8.0-1067.68

ubuntu/linux-lowlatency<6.8.0-147.147.1

6.8.0-147.147.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia<6.8.0-1067.70

6.8.0-1067.70

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17*

ubuntu/linux-nvidia-7.0<7.0.0-1018.18~24.04.1

7.0.0-1018.18~24.04.1

ubuntu/linux-nvidia-lowlatency*

ubuntu/linux-nvidia-tegra<6.8.0-1035.38

6.8.0-1035.38

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17*

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1064.67

6.8.0-1064.67

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17*

ubuntu/linux-oracle-7.0<7.0.0-1011.11~24.04.1

7.0.0-1011.11~24.04.1

ubuntu/linux-raspi<6.8.0-1068.72

6.8.0-1068.72

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-riscv-7.0<7.0.0-31.31.1~24.04.1

7.0.0-31.31.1~24.04.1

ubuntu/linux-vmware<6.8.0-1008.8

6.8.0-1008.8

ubuntu/linux-xilinx*

ubuntu/linux-bluefield<6.8.0-1033.38

6.8.0-1033.38

ubuntu/linux-raspi-realtime<6.8.0-2056.58

6.8.0-2056.58

ubuntu/linux-realtime<6.8.1-1062.63

6.8.1-1062.63

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17*

ubuntu/linux-aws-fips<6.8.0-1067.70+fips1

6.8.0-1067.70+fips1

ubuntu/linux-azure-fips<6.8.0-1071.79+fips1

6.8.0-1071.79+fips1

ubuntu/linux-fips<6.8.0-147.147+fips1

6.8.0-147.147+fips1

ubuntu/linux-gcp-fips<6.8.0-1071.79+fips1

6.8.0-1071.79+fips1

ubuntu/linux<7.0.0-31.31

7.0.0-31.31

ubuntu/linux-aws<7.0.0-1012.12

7.0.0-1012.12

ubuntu/linux-azure<7.0.0-1014.14

7.0.0-1014.14

ubuntu/linux-azure-fde<7.0.0-1013.13

7.0.0-1013.13

ubuntu/linux-gcp<7.0.0-1011.11

7.0.0-1011.11

ubuntu/linux-gke<7.0.0-1006.7

7.0.0-1006.7

ubuntu/linux-ibm<7.0.0-1013.13

7.0.0-1013.13

ubuntu/linux-nvidia<7.0.0-1018.18

7.0.0-1018.18

ubuntu/linux-nvidia-bos<7.0.0-2018.18

7.0.0-2018.18

ubuntu/linux-oem-7.0<7.0.0-1013.13

7.0.0-1013.13

ubuntu/linux-oracle<7.0.0-1011.11

7.0.0-1011.11

ubuntu/linux-raspi<7.0.0-1019.19

7.0.0-1019.19

ubuntu/linux-realtime<7.0.0-31.31.1

7.0.0-31.31.1

ubuntu/linux-riscv<7.0.0-31.31.1

7.0.0-31.31.1

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1116.123~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1122.131~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1121.130~20.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1118.128~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-194.204~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1110.114~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1111.117~20.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-194.204~20.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1068.70~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1114.120~20.04.1
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1110.114~20.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-194.204
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1116.123
Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1069.74~22.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1122.131
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1073.82~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1121.130
Upgrade
Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1071.78~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1117.127
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1073.81~22.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1112.118
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1099.107
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1110.114
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1069.70~22.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1111.117
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1108.113
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-194.204
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-149.149.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1111.112
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 5.15.0-1068.70
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.
Fixed in 5.15.0-1057.57
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1113.119
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1067.71~22.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1110.113
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.15.0-1079.83
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1100.102
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1108.110
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1115.124
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1064.65~22.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1116.123+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1122.131+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-194.204+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1116.126+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-147.147
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1067.70
Upgrade
Upgrade ubuntu/linux-aws-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1012.12~24.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1071.79
Upgrade
Upgrade ubuntu/linux-azure-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 6.8.0-1069.76
Upgrade
Upgrade ubuntu/linux-azure-fde-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13~24.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1071.79
Upgrade
Upgrade ubuntu/linux-gcp-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1011.11~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1066.74
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1052.56
Upgrade
Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-31.31~24.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1067.68
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-147.147.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1067.70
Upgrade
Upgrade ubuntu/linux-nvidia-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1018.18~24.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1035.38
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1064.67
Upgrade
Upgrade ubuntu/linux-oracle-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1011.11~24.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1068.72
Upgrade
Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-31.31.1~24.04.1
Upgrade
Upgrade ubuntu/linux-vmware to a version that resolves this vulnerability.
Fixed in 6.8.0-1008.8
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1033.38
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2056.58
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1062.63
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1067.70+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1071.79+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-147.147+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1071.79+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 7.0.0-31.31
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 7.0.0-1012.12
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 7.0.0-1011.11
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 7.0.0-1006.7
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 7.0.0-1018.18
Upgrade
Upgrade ubuntu/linux-nvidia-bos to a version that resolves this vulnerability.
Fixed in 7.0.0-2018.18
Upgrade
Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 7.0.0-1011.11
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 7.0.0-1019.19
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 7.0.0-31.31.1
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 7.0.0-31.31.1

Event History

Jul 19, 2026

CVE Published

via MITRE·12:02 PM

Data Sourced

via MITRE·12:02 PM

DescriptionSeverity

Data Sourced

via OSV·12:16 PM

DescriptionSeverityAffected Software

Data Sourced

via NVD·12:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Data Sourced

via Red Hat·01:03 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-63808?

CVE-2026-63808 has a critical severity rating of 9.8 according to the CVSS v3.1 system.

What type of vulnerability is CVE-2026-63808?

CVE-2026-63808 is categorized as a 'Use After Free' vulnerability in the Linux kernel.

How do I fix CVE-2026-63808?

To fix CVE-2026-63808, you should update your Linux kernel to the latest patched version provided by the Linux Kernel Project.

What potential impact does CVE-2026-63808 have?

CVE-2026-63808 can lead to a denial of service or arbitrary code execution due to a use-after-free condition.

In which component of the Linux kernel does CVE-2026-63808 occur?

CVE-2026-63808 occurs in the exfat filesystem implementation of the Linux kernel.

CVE-2026-63808: exfat: fix potential use-after-free in exfat_find_dir_entry()

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2026-63808?

What type of vulnerability is CVE-2026-63808?

How do I fix CVE-2026-63808?

What potential impact does CVE-2026-63808 have?

In which component of the Linux kernel does CVE-2026-63808 occur?

Company

Resources

Contact