What is the CVSS score of CVE-2026-63824?

CVE-2026-63824 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-63824?

A memory corruption flaw in the Linux kernel's cryptographic key management system enables authenticated local users to achieve privilege escalation, creating material risk for organizations where…. A patch is available.

How to fix or mitigate CVE-2026-63824?

Within 24 hours, identify all Linux servers in your environment using your asset management system and prioritize those where multiple users have local access or elevated privileges. Within 7 days, test the available kernel security patch released by your Linux distribution vendor (Red Hat, Canonical, Debian, etc.) in a staging environment to confirm compatibility with running applications. Within 30 days, deploy the patched kernel across all production systems through coordinated maintenance windows, with all systems rebooted to activate the security update.

Linux Kernel CVE-2026-63824

EUVD-2026-45490 HIGH

2026-07-19 Linux

GHSA-734m-rp66-35q4

Buffer Overflow Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Reachable only via a local syscall by an authenticated user (AV:L, PR:L) with no interaction; a kernel-heap overflow plausibly yields high confidentiality, integrity, and availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.0 HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 15:43 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 14:17 EUVD

CVE Published

Jul 19, 2026 - 12:02 cve.org

HIGH 7.8

CVE Published

Jul 19, 2026 - 12:02 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

KEYS: fix overflow in keyctl_pkey_params_get_2()

The length for the internal output buffer is calculated incorrectly, which can result overflow when a too small buffer is provided.

Fix the bug by allocating internal output with the size of the maximum length of the cryptographic primitive instead of caller provided size.

AnalysisAI

Local privilege-relevant memory corruption in the Linux kernel's KEYS subsystem allows an authenticated local user to overflow an internal output buffer via the keyctl() public-key operation path. The flaw stems from keyctl_pkey_params_get_2() sizing its internal output buffer using the caller-supplied length instead of the cryptographic primitive's maximum length, so a too-small buffer triggers a heap overflow. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not on CISA KEV, so risk is theoretical rather than actively exploited.

Technical ContextAI

The vulnerability lives in the kernel keyrings/KEYS subsystem, specifically the asymmetric-key (public-key) operation handling reached through the keyctl(2) syscall (KEYCTL_PKEY_* operations such as sign/verify/encrypt/decrypt). keyctl_pkey_params_get_2() parses user-supplied parameters and prepares an internal output buffer for the crypto primitive result. The root cause is a length-calculation error: the code derives the internal buffer size from the caller-provided output length rather than from the maximum output size of the underlying cryptographic primitive (e.g., the modulus/key size), so a caller passing a small buffer causes the primitive to write beyond the allocation. Although the NVD entry lists CWE as N/A, this is a classic buffer overflow (out-of-bounds write, CWE-787/CWE-131 incorrect buffer size calculation), corroborated by the 'Buffer Overflow' tag. The affected code path requires the asymmetric key type and public-key crypto support compiled into the kernel.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.38, or 7.1.3 (mainline 7.2-rc1), matching whichever stable series your distribution ships, then reboot to load the patched kernel. If you build from source, apply the corresponding stable-tree fix commit from git.kernel.org (e.g. 622ec2dcd59f21623f2a7ab773c80ceb7d555e3a for the relevant branch). Where immediate patching is not possible, the exposure requires reaching the KEYCTL public-key operations, so a compensating control is to restrict who can invoke sensitive keyctl paths - for example confining workloads with a seccomp-bpf profile that blocks or filters the keyctl(2) syscall for untrusted processes (trade-off: applications legitimately using kernel keyrings for signing/verification will break), and limiting untrusted local/interactive user access on affected hosts. Track advisory detail at https://nvd.nist.gov/vuln/detail/CVE-2026-63824 and https://vuldb.com/vuln/380503.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-63824 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63824

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code