What is the CVSS score of CVE-2026-63906?

CVE-2026-63906 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-63906?

CVE-2026-63906 impacts Linux-based IoT and embedded devices using TI OMAP2430 processors, creating a high-severity risk where attackers could disable or compromise device control; no public exploit…. A patch is available.

How to fix or mitigate CVE-2026-63906?

Within 24 hours, identify and inventory all systems using TI OMAP2430 architecture (query device specifications, check /proc/cpuinfo, or contact device manufacturers) and confirm current kernel versions against upstream stable branches with known vulnerabilities. Within 7 days, deploy upstream stable kernel patches containing the omap2430_probe() fix to all production OMAP2430 devices; coordinate with device manufacturers if using proprietary or customized kernel distributions. Within 30 days, complete a comprehensive audit of OMAP2430 inventory, verify patch deployment across all systems, and document any legacy or embedded devices unable to patch for risk acceptance or compensating-control implementation.

Linux Kernel CVE-2026-63906

EUVD-2026-45679 HIGH

2026-07-19 Linux

GHSA-75x6-rxh4-mhv7

Information Disclosure Linux

8.4

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Probe/bind-time use-after-free needs local access and typically privileged driver-bind control (PR:L) plus winning a refcount race (AC:H); kernel memory corruption yields high C/I/A.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:12 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

8.4 (HIGH)

Patch available

Jul 19, 2026 - 17:19 EUVD

CVE Published

Jul 19, 2026 - 14:55 cve.org

HIGH 8.4

CVE Published

Jul 19, 2026 - 14:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

usb: musb: omap2430: Fix use-after-free in omap2430_probe()

In omap2430_probe(), of_node_put(np) is called prematurely before the last access to np, leading to a use-after-free if the node's reference count drops to zero. Move the of_node_put() calls after the last use of np in both the success and error paths.

AnalysisAI

Memory corruption in the Linux kernel's USB MUSB OMAP2430 glue driver (drivers/usb/musb/omap2430.c) stems from a use-after-free in omap2430_probe(), where of_node_put() releases the device-tree node reference before the node is last accessed. On affected TI OMAP2430-class platforms an attacker able to influence driver probe (device bind/unbind, hotplug, or device-tree handling) could trigger access to freed kernel memory, potentially corrupting kernel state. EPSS is low (0.21%, 11th percentile) and there is no public exploit identified at time of analysis; the fix is merged upstream across multiple stable branches.

Technical ContextAI

The flaw lives in the MUSB (Mentor Graphics USB dual-role controller) OMAP2430 platform glue layer of the Linux USB subsystem, which binds the MUSB core to Texas Instruments OMAP2430/OMAP-class SoCs. During omap2430_probe(), the driver walks and dereferences an OF (Open Firmware / device-tree) node pointer 'np', but calls of_node_put(np) - which decrements the node's kref reference count - too early. If that put drops the count to zero the node is freed, yet subsequent code still dereferences 'np', producing a classic use-after-free (CWE-416, though the feed reports CWE as N/A). The CPE data is generic (cpe:2.3:a:linux:linux:*) and does not pin exact versions, so the affected range must be read from the stable-tree commits rather than CPE.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.1.176, 6.6.143, 6.12.93, 6.18.35, or 7.0.12 (or later) matching your branch - which moves the of_node_put() calls after the last use of 'np' in both success and error paths. Apply the specific backport commit for your tree from https://git.kernel.org/stable/c/632fd888fe33083927e29ef651ac1aba345edd9e (and the corresponding branch commits b987f380620b38c84f054d5ff5c05861a7c2203b, 27e62532228dc42367bb43ebbcd7bf49d8db2b0d, 69f9f2b30af03d9b6e83f78fb0f734b6066d4678, d53e4c41331f57b9fd78cbf3e480c6ce20aea07b, e194ce048f5a6c549b3a23a8c568c6470f40f772). If you cannot patch immediately, the practical compensating control is to not load the omap2430 MUSB glue driver on systems that do not require it (blacklist the module), which eliminates exposure at the cost of disabling MUSB USB dual-role functionality on that hardware; there is no runtime configuration toggle for the flaw itself, so patching is the only complete fix.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-63906 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63906

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code