What is the CVSS score of CVE-2026-63865?

CVE-2026-63865 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-63865?

CVE-2026-63865 affects the Linux kernel BPF LSM subsystem, allowing privileged local attackers to trigger kernel panics that disrupt system availability.. A patch is available.

How to fix or mitigate CVE-2026-63865?

Immediately (within 24 hours): Identify all Linux systems with BPF LSM subsystem enabled and determine which allow unprivileged local user access or have shared user accounts. Within 7 days: Obtain the patched kernel version from your Linux distribution vendor and test it in a staging environment to ensure compatibility with your BPF LSM workloads. Within 30 days: Deploy the patched kernel to production systems, prioritizing shared hosting platforms and multi-tenant environments where the risk is highest.

Linux Kernel CVE-2026-63865

EUVD-2026-45549 HIGH

2026-07-19 Linux

GHSA-cx6c-jx3r-hwpq

Information Disclosure Linux

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

4.4 MEDIUM

Loading BPF LSM programs needs CAP_BPF/CAP_SYS_ADMIN (PR:H) and local access (AV:L); the sleep-in-atomic fault causes a crash/DoS (A:H) with no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:01 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

8.8 (HIGH)

Patch available

Jul 19, 2026 - 16:19 EUVD

CVE Published

Jul 19, 2026 - 14:04 cve.org

HIGH 8.8

CVE Published

Jul 19, 2026 - 14:04 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks

bpf_lsm_task_to_inode() is called under rcu_read_lock() and bpf_lsm_inet_conn_established() is called from softirq context, so neither hook can be used by sleepable LSM programs.

AnalysisAI

Denial-of-service / kernel-stability defect in the Linux kernel BPF LSM subsystem allows a privileged BPF program author to attach sleepable LSM programs to the bpf_lsm_task_to_inode() and bpf_lsm_inet_conn_established() hooks, which execute in atomic contexts (under rcu_read_lock() and in softirq respectively) where sleeping is illegal. The upstream fix removes these two hooks from the sleepable-eligible set; there is no public exploit identified at time of analysis, EPSS is very low (0.16%, 6th percentile), and it is not in CISA KEV. Despite an NVD CVSS of 8.8 the real-world risk is modest because triggering requires local privilege to load BPF LSM programs.

Technical ContextAI

The affected technology is the Linux kernel's BPF LSM (Linux Security Module) framework, which lets operators attach eBPF programs to security hooks. Some BPF LSM programs may be marked 'sleepable' (BPF_F_SLEEPABLE), permitting them to call helpers that block/sleep. The kernel maintains an allowlist of which LSM hooks are safe for sleepable programs. Two hooks were incorrectly included: bpf_lsm_task_to_inode() runs inside an rcu_read_lock() critical section, and bpf_lsm_inet_conn_established() runs in softirq (bottom-half interrupt) context. Sleeping in either context violates kernel atomicity rules and can lead to a scheduling-while-atomic BUG, RCU stalls, or deadlock. CWE is listed as N/A, but the root cause is a class of concurrency/atomic-context correctness error (sleeping in an atomic section) rather than a memory-safety bug; the vendor tag of 'Information Disclosure' is not clearly supported by the technical description, which centers on illegal sleeping.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.1.175, 5.15.209, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 (or later within each series), pulling the commit that drops task_to_inode and inet_conn_established from the sleepable LSM hook allowlist (git.kernel.org/stable/c/26b380a3ca0b605fd8860995ed6a208f276dd316 and siblings). If immediate patching is not possible, the practical compensating control is to restrict who can load BPF programs: ensure unprivileged BPF is disabled (sysctl kernel.unprivileged_bpf_disabled=1), avoid granting CAP_BPF/CAP_SYS_ADMIN to untrusted workloads/containers, and do not deploy sleepable BPF LSM programs attached to these two hooks. The trade-off of disabling unprivileged/broad BPF access is reduced flexibility for legitimate observability and security tooling that relies on eBPF. Consult the CVE-2026-63865 NVD page and the linked kernel.org stable commits for the exact per-branch fix.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-63865 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63865

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code