CVE-2026-63810: Linux Kernel Privilege Escalation Flaw

CVE-2026-63810 Overview

CVE-2026-63810 is a NULL pointer dereference vulnerability in the Linux kernel block layer. The flaw resides in the bdev pseudo-filesystem, an internal kernel filesystem that was reachable from userspace via mount operations. When userspace mounts the bdev pseudo-filesystem and invokes move_mount(), the kernel dereferences function pointers in the inode_operations structure. These pointers are unset because bdev inodes use empty_iops, causing a NULL instruction fetch and kernel oops.

The issue was discovered through Syzkaller fuzzing by the Linux Verification Center (linuxtesting.org). The fix unregisters the bdev pseudo-filesystem so userspace cannot attempt to mount it.

Critical Impact
A local unprivileged process can trigger a kernel NULL pointer dereference by mounting the bdev pseudo-filesystem and issuing file operations, resulting in a kernel oops and denial of service.

Affected Products

Linux kernel (block subsystem, bdev pseudo-filesystem)
Linux kernel 6.1.155-syzkaller build confirmed vulnerable in the crash trace
Distributions shipping affected upstream kernel versions prior to the referenced stable commits

Discovery Timeline

2026-07-19 - CVE-2026-63810 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-63810

Vulnerability Analysis

The bdev pseudo-filesystem is an internal kernel construct used to represent block devices as inodes. It was registered with the VFS layer in a way that allowed userspace to attempt to mount it. Because the filesystem is not intended for userspace interaction, its inodes are initialized with inode->i_op = &empty_iops;, where empty_iops contains only NULL function pointers.

When userspace mounts the bdev filesystem and calls move_mount() followed by path resolution, the VFS invokes lookup_open() in fs/namei.c. This code path calls into inode_operations handlers without validating that the operation pointers are populated. The result is an instruction fetch at address 0x0, producing the following crash: BUG: kernel NULL pointer dereference, address: 0000000000000000 with RIP: 0010:0x0.

The crash trace shows the fault triggered from __x64_sys_openat → do_filp_open → path_openat → lookup_open. Any local user able to issue mount and open syscalls can reach the vulnerable path, leading to a kernel oops.

Root Cause

The root cause is that the bdev pseudo-filesystem remained registered and mountable from userspace despite being an internal-only interface. Its inodes carry an empty inode_operations table, and the VFS assumes handlers such as lookup and create are non-NULL when servicing path resolution. This is a kernel design flaw where an internal filesystem was inadvertently exposed to userspace [CWE-476].

Attack Vector

Exploitation requires local access. An unprivileged attacker mounts the bdev pseudo-filesystem, then issues a path-based syscall such as openat() targeting a path inside that mount. The subsequent call to lookup_open() dereferences a NULL function pointer in empty_iops, crashing the kernel. Because the crash occurs in a common VFS path, no specialized primitives are required beyond ordinary syscalls. The impact is a system-wide denial of service through kernel panic on affected configurations.

No public proof-of-concept exploit is listed in the enriched data, and the vulnerability is not tracked in CISA KEV. The EPSS value from the enriched data is 0.168%.

See the upstream fix at the Linux Kernel Commit which unregisters the bdev pseudo-filesystem from the VFS.

Detection Methods for CVE-2026-63810

Indicators of Compromise

Kernel log entries containing BUG: kernel NULL pointer dereference, address: 0000000000000000 with RIP: 0010:0x0 and a call trace originating in lookup_open or path_openat.
Unexpected system crashes or hangs following mount syscalls referencing the bdev filesystem type from unprivileged processes.
Presence of bdev entries in /proc/filesystems on kernels that should have unregistered it.

Detection Strategies

Monitor dmesg and journald for oops signatures pointing to fs/namei.c:3460 in lookup_open.isra.0 on affected kernel builds.
Audit mount() and move_mount() syscalls issued by non-root processes using auditd rules and flag attempts referencing internal filesystem types.
Inventory running kernel versions across the fleet and correlate against the fixed stable commits referenced in the NVD advisory.

Monitoring Recommendations

Forward kernel crash dumps and kdump output to a centralized log platform for retention and correlation.
Alert on repeated kernel oops events on the same host, which may indicate ongoing exploitation attempts or fuzzing activity.
Track user namespace and mount namespace creation by unprivileged users, since these often precede mount-based kernel triggers.

How to Mitigate CVE-2026-63810

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the NVD advisory as soon as vendor packages become available.
Restrict unprivileged user namespace creation by setting kernel.unprivileged_userns_clone=0 where the workload permits, reducing the ability of unprivileged users to invoke mount().
Enable kernel crash reporting (kdump) to capture forensic data if the oops is triggered before patching completes.

Patch Information

The fix unregisters the bdev pseudo-filesystem so that userspace can no longer attempt to mount it. Stable commits are published in the mainline and stable trees. See the following upstream references:

Track distribution security advisories for backports to your specific kernel branch.

Workarounds

Disable unprivileged user namespaces to prevent local users from invoking mount syscalls on arbitrary filesystem types.
Use seccomp filters to block mount() and move_mount() syscalls for untrusted workloads and container runtimes.
Apply MAC policies (SELinux, AppArmor) that deny mount operations for non-administrative service accounts.

bash

# Configuration example: reduce local attack surface until patching
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' > /etc/sysctl.d/99-cve-2026-63810.conf

# Verify the current kernel version against fixed stable commits
uname -r

# Watch for oops signatures related to this bug
journalctl -k --since "1 hour ago" | grep -E "NULL pointer|lookup_open|path_openat"