Critical 9.8Published Jul 19, 2026

CVE-2026-63808exfat: fix potential use-after-free in exfat_find_dir_entry()

Updated under an hour ago (Oct 26, 2026, 1:40 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: exfat: fix potential use-after-free in exfat_find_dir_entry() In exfat_find_dir_entry(), the buffer_head obtained from exfat_get_dentry() is released with brelse(bh) before the fall-through TYPE_EXTEND branch reads the directory entry through ep (which points into bh->b_data): brelse(bh); if (entry_type == TYPE_EXTEND) { ... len = exfat_extract_uni_name(ep, entry_uniname); ... } After brelse() drops our reference, nothing guarantees that the underlying page backing bh->b_data remains valid for the subsequent exfat_extract_uni_name() read. This is the same pattern fixed in commit fc961522ddbd ("exfat: Fix potential use after free in exfat_load_upcase_table()"). Move brelse(bh) so it runs after ep is no longer dereferenced on each branch. Confirmed on QEMU x86_64 with CONFIG_KASAN=y + CONFIG_DEBUG_PAGEALLOC=y + CONFIG_PAGE_POISONING=y on linux-next, using a crafted exFAT image (long filename with same-hash collisions forcing the TYPE_EXTEND path). With a debug-only invalidate_bdev() inserted between brelse(bh) and the ep read to make the stale-deref window deterministic, the unpatched kernel faults: BUG: KASAN: use-after-free in exfat_find_dir_entry+0x133b/0x15a0 BUG: unable to handle page fault for address: ffff88801a5fa0c2 Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI RIP: 0010:exfat_find_dir_entry+0x1188/0x15a0 With this patch applied, the same instrumented harness completes cleanly under the same sanitizer stack. I have not reproduced a crash on an uninstrumented kernel under ordinary reclaim; the instrumented A/B establishes the lifetime violation and that the patch closes it, not an unaided triggerability claim.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ca06197382bde0a3bc20215595d1c9ce20c6e341 before e6f1a11cfb808441a43ffae9b476cc135732cd27; from ca06197382bde0a3bc20215595d1c9ce20c6e341 before e48f413c2815787b8cade2795e194e3c4cd782ef; from ca06197382bde0a3bc20215595d1c9ce20c6e341 before 06c4e1e9967d332ac33ba38b7819851089ff9359; from ca06197382bde0a3bc20215595d1c9ce20c6e341 before 8e0abc17fbd7e305802e84fe98b4950d50f9c433; from ca06197382bde0a3bc20215595d1c9ce20c6e341 before 4d101016d5e587f820b3ae2d5bb6770d86342649; from ca06197382bde0a3bc20215595d1c9ce20c6e341 before adfacfbaeae2cb760f492357cc36b41f84ef7f86; from ca06197382bde0a3bc20215595d1c9ce20c6e341 before 708b97e792945d3e4653939fd3405d71a61ad065; from ca06197382bde0a3bc20215595d1c9ce20c6e341 before 3f5f8ee9917cc2b9076ac533492d8a200edcabb8	CNA record
linux linux_kernel linux:linux_kernel	from 5.7 before 5.10.260; from 5.11 before 5.15.211; from 5.16 before 6.1.177; from 6.2 before 6.6.144; from 6.7 before 6.12.95; from 6.13 before 6.18.38; from 6.19 before 7.1.3	NVD

References

References

https://git.kernel.org/stable/c/e6f1a11cfb808441a43ffae9b476cc135732cd27	patch
https://git.kernel.org/stable/c/e48f413c2815787b8cade2795e194e3c4cd782ef	patch
https://git.kernel.org/stable/c/06c4e1e9967d332ac33ba38b7819851089ff9359	patch
https://git.kernel.org/stable/c/8e0abc17fbd7e305802e84fe98b4950d50f9c433	patch
https://git.kernel.org/stable/c/4d101016d5e587f820b3ae2d5bb6770d86342649	patch
https://git.kernel.org/stable/c/adfacfbaeae2cb760f492357cc36b41f84ef7f86	patch
https://git.kernel.org/stable/c/708b97e792945d3e4653939fd3405d71a61ad065	patch
https://git.kernel.org/stable/c/3f5f8ee9917cc2b9076ac533492d8a200edcabb8	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.