What is the CVSS score of CVE-2026-63858?

CVE-2026-63858 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Linux Kernel are affected by CVE-2026-63858?

CVE-2026-63858 is a local kernel memory vulnerability in Linux netfilter operations that permits privilege escalation and sensitive kernel data disclosure within containerized or shared-user…. A patch is available.

How to fix or mitigate CVE-2026-63858?

Within 24 hours, inventory all Linux systems running netfilter capabilities and identify kernel versions against upstream stable advisories; prioritize systems with unprivileged user namespace support enabled. Within 7 days, test Linux kernel stable updates addressing CVE-2026-63858 in staging and development environments to validate compatibility and performance. Within 30 days, deploy patched kernels across production systems in rolling fashion, beginning with environments where developers or containers hold netfilter capabilities, followed by coordinated reboots to activate fixes.

Linux Kernel CVE-2026-63858

EUVD-2026-45542 HIGH

2026-07-19 Linux

GHSA-w348-qxhm-w5rx

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local netfilter-admin access gives PR:L and AV:L; the defect is a timing race against RCU dump readers, so AC:H; a kernel UAF plausibly yields high C/I/A.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 15:58 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 16:19 EUVD

CVE Published

Jul 19, 2026 - 14:04 cve.org

HIGH 7.8

CVE Published

Jul 19, 2026 - 14:04 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: add hook transactions for device deletions

Restore the flag that indicates that the hook is going away, ie. NFT_HOOK_REMOVE, but add a new transaction object to track deletion of hooks without altering the basechain/flowtable hook_list during the preparation phase.

The existing approach that moves the hook from the basechain/flowtable hook_list to transaction hook_list breaks netlink dump path readers of this RCU-protected list.

It should be possible use an array for nft_trans_hook to store the deleted hooks to compact the representation but I am not expecting many hook object, specially now that wildcard support for devices is in place.

Note that the nft_trans_chain_hooks() list contains a list of struct nft_trans_hook objects for DELCHAIN and DELFLOWTABLE commands, while this list stores struct nft_hook objects for NEWCHAIN and NEWFLOWTABLE. Note that new commands can be updated to use nft_trans_hook for consistency.

This patch also adapts the event notification path to deal with the list of hook transactions.

AnalysisAI

Local privilege escalation and kernel-memory disclosure in the Linux kernel netfilter nf_tables subsystem arises from unsafe handling of basechain/flowtable hook deletions, where moving hooks off an RCU-protected hook_list during the transaction preparation phase races with concurrent netlink dump readers. A low-privileged local user with netfilter administration capability (typically CAP_NET_ADMIN, obtainable inside an unprivileged user namespace on many distros) can trigger the race to read or corrupt freed kernel memory. There is no public exploit identified at time of analysis, EPSS exploitation probability is low (0.14%, 4th percentile), and the issue is not in CISA KEV; the fix is available as upstream stable commits.

Technical ContextAI

nf_tables is the modern packet-classification and firewalling framework in the Linux kernel (successor to iptables), configured over a netlink socket. Basechains and flowtables attach to network devices via 'hooks' tracked in a hook_list that is read concurrently by the netlink dump path under RCU protection. The buggy pre-fix approach removed hooks from the live basechain/flowtable hook_list and spliced them onto a per-transaction list during the commit preparation phase; because dump-path readers iterate this RCU-protected list without the transaction lock, mutating list membership out from under them breaks the reader (a classic RCU list-manipulation/use-after-free and concurrency defect). The fix reintroduces the NFT_HOOK_REMOVE flag and adds a dedicated nft_trans_hook transaction object so pending deletions are recorded without altering the RCU-visible hook_list until commit, and adapts the event-notification path accordingly. No formal CWE was assigned; the root-cause class is a concurrency/RCU race leading to use-after-free (CWE-362 / CWE-416).

RemediationAI

Apply the vendor patch by upgrading to a distribution kernel that incorporates upstream stable fix commits 4e69bfb32b2db323d9205fdb30e284481b37817c and 10f79dbd7719d1da9f5884d13060322d8729f091 (Vendor-released patch: upstream stable commits; see https://git.kernel.org/stable/c/4e69bfb32b2db323d9205fdb30e284481b37817c and https://git.kernel.org/stable/c/10f79dbd7719d1da9f5884d13060322d8729f091), then reboot into the fixed kernel. Where immediate patching is not possible, reduce reachability of the vulnerable code path: disable unprivileged user namespaces (set sysctl kernel.unprivileged_userns_clone=0 on Debian/Ubuntu, or user.max_user_namespaces=0) to prevent unprivileged users from gaining the CAP_NET_ADMIN needed to manipulate nf_tables, accepting that this may break container runtimes and sandboxes that rely on user namespaces; alternatively restrict nftables administration to trusted users and constrain untrusted workloads with seccomp/LSM policy that blocks the netlink NETFILTER family. These are mitigations that narrow the attack surface, not a substitute for the kernel update; verify each against your container and networking dependencies before rollout.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-63858 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63858

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code