What is the CVSS score of CVE-2026-63860?

CVE-2026-63860 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-63860?

A Linux kernel RDMA subsystem vulnerability (CVE-2026-63860, CVSS 8.4) could allow local actors with RDMA netlink access to crash systems or leak sensitive kernel memory.. A patch is available.

How to fix or mitigate CVE-2026-63860?

Within 24 hours, audit your Linux inventory to identify all systems with RDMA/Infiniband functionality enabled and document their current kernel versions. Within 7 days, deploy the vendor-released kernel patch to all affected systems through standard change management, prioritizing systems processing sensitive data or supporting critical services. Within 30 days, confirm full patch deployment across the environment and implement kernel log monitoring for exploitation attempts or memory access anomalies.

Linux Kernel CVE-2026-63860

EUVD-2026-45544 HIGH

2026-07-19 Linux

GHSA-cqch-vjq7-8xrc

Information Disclosure Linux

8.4

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

RDMA netlink access is local and normally needs CAP_NET_ADMIN (PR:L, AV:L); an out-of-bounds read yields info disclosure (C:H) and possible crash (A:H) but no integrity impact (I:N).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

4.4 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 15:59 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

8.4 (HIGH)

Patch available

Jul 19, 2026 - 16:19 EUVD

CVE Published

Jul 19, 2026 - 14:04 cve.org

HIGH 8.4

CVE Published

Jul 19, 2026 - 14:04 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Prefer NLA_NUL_STRING

These attributes are evaluated as c-string (passed to strcmp), but NLA_STRING doesn't check for the presence of a \0 terminator.

Either this needs to switch to nla_strcmp() and needs to adjust printf fmt specifier to not use plain %s, or this needs to use NLA_NUL_STRING.

As the code has been this way for long time, it seems to me that userspace does include the terminating nul, even tough its not enforced so far, and thus NLA_NUL_STRING use is the simpler solution.

AnalysisAI

Out-of-bounds string handling in the Linux kernel RDMA subsystem (drivers/infiniband/core) allows a local actor with RDMA netlink access to trigger reads past the end of a supplied netlink attribute. The affected code declared configuration attributes as NLA_STRING and then passed them directly to strcmp()/%s formatting without guaranteeing a NUL terminator, so a crafted, unterminated attribute can cause the kernel to read adjacent memory, potentially leaking information or crashing the host. No public exploit identified at time of analysis; the fix simply switches the attributes to NLA_NUL_STRING to enforce termination.

Technical ContextAI

The vulnerability lives in the RDMA/core (InfiniBand core) netlink configuration path. Linux netlink attribute policies distinguish NLA_STRING (a byte blob with no guaranteed trailing NUL) from NLA_NUL_STRING (validated to contain a terminating '\0'). The offending handlers treated NLA_STRING payloads as C strings - feeding them to strcmp() and plain %s printf specifiers - which read until a NUL byte is encountered. If userspace omits the terminator, these routines walk past the attribute buffer boundary, the classic improper null-termination / out-of-bounds read class (CWE-170 / CWE-125). The maintainer's chosen remedy is to re-declare the attributes as NLA_NUL_STRING so the netlink core rejects unterminated input before the string is ever dereferenced. The CPE data identifies the affected component only generically as cpe:2.3:a:linux:linux:*, i.e. the mainline kernel across all listed branches.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 (or later) on the matching branch - and apply your distribution's backport once available. The upstream fix is available as stable commits on git.kernel.org (e.g. https://git.kernel.org/stable/c/fcd07d3b8ee7a39b344d73aed69c1a68cd9eacdf) and re-declares the affected RDMA netlink attributes as NLA_NUL_STRING. Where immediate patching is not possible, reduce exposure by restricting who can issue RDMA configuration netlink commands - the trigger path is reachable through the RDMA netlink interface, which normally requires CAP_NET_ADMIN, so avoid granting that capability to untrusted local users or containers and unload/blacklist the InfiniBand/RDMA core modules (ib_core and dependents) on systems that do not use RDMA. Trade-off: unloading RDMA modules disables InfiniBand/RoCE/iWARP functionality, so this is only viable on hosts with no RDMA workload; tightening CAP_NET_ADMIN may affect network-management tooling in the same namespace.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-63860 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63860

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code