CVE-2026-63994

Exploitation

Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.

SSVC decision

Not assessed by CISA

EPSS probability

0.51% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 41.4% of scored records. A rank, not a probability.

NVD base score

9.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Awaiting Analysis. NVD last modified this record on 2026-07-30.

Red Hat severity

Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2026-07-19 14:56Z1 MO AGO

Last updated

2026-08-05 12:37Z1 MO AGO

Reserved

2026-07-19

Assigning CNA

Linux

Record state

PUBLISHED

Severity

Critical (CVSS 9.8)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

• CWE-825Expired Pointer DereferenceBase

Data version

5.2

Document digest

5ce87bea9a44d7a947d0ce343ee74193820f8b8cdfb81d9c21c35da82deca5f2

• git.kernel.orghttps://git.kernel.org/stable/c/95b6d772bfe788331d9742d73eaa12e113b2adc4
• git.kernel.orghttps://git.kernel.org/stable/c/7254aef4d1a7e18e887af9010e2f2dc34806789b
• git.kernel.orghttps://git.kernel.org/stable/c/bf8b3f34c37c162357138e7c0942723b8b94fed1
• git.kernel.orghttps://git.kernel.org/stable/c/76cd9398a0470257ab765bdf5f358a2af2e17934
• git.kernel.orghttps://git.kernel.org/stable/c/50750d86a2e5266aba0c295483b3397843198b11
• git.kernel.orghttps://git.kernel.org/stable/c/6dff77899b9e9fe5d854abda3a98ad04e7229ef7
• git.kernel.orghttps://git.kernel.org/stable/c/f3f204541f280a6ecb04503a0d6794d93990ca43
• git.kernel.orghttps://git.kernel.org/stable/c/b4bc94353050b1fa7b702bd4c6600710dd926cff