CVE-2026-63809: Linux Kernel Use-After-Free Vulnerability

CVE-2026-63809 Overview

CVE-2026-63809 is a memory corruption vulnerability in the Linux kernel BPF subsystem. The flaw resides in __cgroup_bpf_run_filter_sysctl(), which frees a sysctl write buffer using kfree() even when the buffer was allocated by kvzalloc(). Because kvzalloc() can transparently fall back to vmalloc() for large allocations, calling kfree() on a vmalloc-backed pointer corrupts kernel memory. A local, low-privileged attacker with write access to a /proc/sys/ entry inside a target cgroup can trigger the fault by writing a sufficiently large payload.

Critical Impact
Local attackers can corrupt kernel memory through crafted writes to /proc/sys/ entries, resulting in kernel crashes and potential privilege escalation.

Affected Products

Linux kernel versions prior to the fix in the mainline tree
Linux kernel stable branches referenced by upstream commits 4c21b59, 65bd0c0, 70df4de, 77355ef, 81fc9a1, 838fe9c, d0a81ed, and e1d1e20
The bug was confirmed present in kernel v7.1-rc5 and reproduced on v7.1-rc4

Discovery Timeline

2026-07-19 - CVE-2026-63809 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63809

Vulnerability Analysis

The vulnerability is a kernel memory corruption bug ([CWE-763]-class mismatched deallocator) in the cgroup BPF sysctl filter path. proc_sys_call_handler() allocates its temporary sysctl buffer with kvzalloc() and passes the pointer to __cgroup_bpf_run_filter_sysctl(). When a BPF program replaces the write buffer, the replacement path in __cgroup_bpf_run_filter_sysctl() releases the original buffer with kfree().

kvzalloc() returns either a kmalloc-backed or a vmalloc-backed allocation depending on request size. Freeing a vmalloc allocation through kfree() dereferences an invalid slab page descriptor and corrupts kernel state. Reproducers confined to the proc_sys_call_handler() range under CONFIG_FAILSLAB produced a page fault at kfree+0x6e/0x510 when writing 8191 bytes to /proc/sys/kernel/domainname from a task in the target cgroup.

Root Cause

The root cause is an allocator/deallocator mismatch. The producer side uses kvzalloc(), which is a hybrid allocator, while the release side uses kfree(), which only handles slab allocations. The correct deallocator, kvfree(), safely handles both kmalloc and vmalloc-backed pointers.

Attack Vector

Exploitation requires local access and the ability to write to a sysctl entry that is subject to a BPF_CGROUP_SYSCTL program that replaces the write buffer. An attacker in a container or unprivileged namespace with permission to write large payloads to a targeted /proc/sys/ node can force the kernel down the replacement path, triggering a kfree() on a vmalloc-backed pointer and inducing kernel memory corruption or a crash.

No verified public exploit code is available. The vulnerability mechanism is documented in the upstream kernel commits listed in the references and is triggered by writing a sysctl payload large enough to push kvzalloc() into its vmalloc fallback path.

Detection Methods for CVE-2026-63809

Indicators of Compromise

Kernel oops or page fault traces containing kfree+ frames called from __cgroup_bpf_run_filter_sysctl+ and proc_sys_call_handler+.
KASAN or slab-corruption warnings referencing __kvmalloc_node_noprof in the preceding call chain.
Unexpected kernel panics correlated with processes writing large buffers to /proc/sys/ from within containers.

Detection Strategies

Enable CONFIG_KASAN and CONFIG_DEBUG_VM on test kernels to surface deallocator mismatches before deployment.
Alert on kernel ring-buffer messages matching BUG: unable to handle page fault with call stacks that include __cgroup_bpf_run_filter_sysctl.
Audit loaded eBPF programs of type BPF_PROG_TYPE_CGROUP_SYSCTL and correlate their presence with anomalous sysctl writes.

Monitoring Recommendations

Ship kernel logs (dmesg, /var/log/kern.log) to a centralized log platform and alert on oops and KASAN reports.
Monitor bpf() syscall activity, especially cgroup program attachments, using auditd or eBPF-based telemetry.
Track write operations against /proc/sys/ paths from unprivileged workloads and containers.

How to Mitigate CVE-2026-63809

Immediate Actions Required

Apply the upstream kernel fix that replaces the errant kfree() call with kvfree() in __cgroup_bpf_run_filter_sysctl().
Update to a stable kernel release that incorporates one of the referenced commits (4c21b59, 65bd0c0, 70df4de, 77355ef, 81fc9a1, 838fe9c, d0a81ed, e1d1e20).
Inventory hosts running custom or vendor kernels near v7.1-rc and prioritize them for patching.

Patch Information

The fix changes the deallocation call in the sysctl replacement path from kfree() to kvfree(), correctly handling buffers returned by kvzalloc() regardless of whether they were satisfied by the slab allocator or by vmalloc(). Patch commits are published on the kernel.org stable tree and mirrored across seven additional stable branch commits linked in the references.

Workarounds

Detach or restrict BPF_CGROUP_SYSCTL programs that call bpf_sysctl_set_new_value() on affected kernels until the patch is applied.
Restrict CAP_BPF and CAP_SYS_ADMIN in untrusted containers to prevent local users from attaching cgroup BPF programs that exercise the replacement path.
Limit unprivileged write access to /proc/sys/ entries governed by cgroup BPF filters through container security policies and seccomp profiles.

bash

# Verify running kernel includes the fix
uname -r
# Confirm patched sources contain kvfree() in the cgroup BPF sysctl path
grep -n 'kvfree' kernel/bpf/cgroup.c