What is the CVSS score of CVE-2026-63911?

CVE-2026-63911 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-63911?

Linux kernel versions 6.14 and later with XFRM IP-TFS tunnel configurations are vulnerable to local privilege escalation through use-after-free memory corruption in IPsec SA cloning.. A patch is available.

How to fix or mitigate CVE-2026-63911?

Within 24 hours, inventory all Linux systems running kernel versions 6.14 or later with IPTFS tunnel configurations to establish scope of exposure-focus on IPsec/VPN gateway and tunnel endpoint systems. Within 7 days, identify available kernel patches from your distribution vendors and validate patches in non-production staging environments; coordinate with infrastructure teams on patch timing and testing requirements. Within 30 days, complete rollout of patched kernel versions to all affected production systems, prioritizing systems with the highest privilege escalation risk and scheduling updates with appropriate maintenance windows.

Linux Kernel CVE-2026-63911

EUVD-2026-45684 HIGH

2026-07-19 Linux

GHSA-3gc2-w5w2-ffch

Information Disclosure Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.4 MEDIUM

Local kernel bug requiring IPTFS config and net-admin control of SA migration (PR:H), triggered via a non-deterministic failure race (AC:H), yielding full memory-corruption impact.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:14 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 17:19 EUVD

CVE Published

Jul 19, 2026 - 14:55 cve.org

HIGH 7.8

CVE Published

Jul 19, 2026 - 14:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

xfrm: iptfs: reset runtime state when cloning SAs

iptfs_clone_state() clones the IPTFS mode data with kmemdup(). This copies runtime objects which must not be shared with the original SA, including the embedded sk_buff_head, hrtimers, spinlock, and in-flight reassembly/reorder state.

If xfrm_state_migrate() fails after clone_state() but before the later init_state() call has reinitialized those fields, the cloned state can be destroyed by xfrm_state_gc_task() with list and timer state copied from the original SA. With queued packets this lets the clone splice and free skbs owned by the original IPTFS queue, leading to use-after-free and double-free reports in iptfs_destroy_state() and skb release paths.

Reinitialize the clone's runtime state before publishing it through x->mode_data. Because clone_state() now publishes a destroyable mode_data object before init_state(), take the mode callback module reference there. Avoid taking it again from __iptfs_init_state() for the same object.

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel's XFRM IP-TFS (IPTFS) tunnel subsystem (introduced in 6.14) arises because iptfs_clone_state() shallow-copies runtime state via kmemdup() during IPsec SA cloning. If xfrm_state_migrate() fails after the clone but before re-initialization, the garbage collector can free skbs still owned by the original SA queue, yielding use-after-free and double-free. A local low-privileged actor able to drive IPsec SA migration on an IPTFS-configured tunnel can trigger the flaw; there is no public exploit identified at time of analysis and EPSS is low (0.20%).

Technical ContextAI

The affected component is the Linux kernel XFRM (IPsec transform) framework's IP-TFS mode (IP Traffic Flow Security, RFC 9347), which aggregates and pads IPsec traffic. IPTFS SAs embed live runtime objects - an sk_buff_head queue, hrtimers, a spinlock, and in-flight reassembly/reorder state. iptfs_clone_state() duplicates the mode data with kmemdup(), a byte-for-byte copy, so the clone shares list pointers, timer state, and queued skbs with the original SA rather than owning independent instances. When xfrm_state_migrate() fails between clone_state() and the later init_state() that would reinitialize those fields, xfrm_state_gc_task() destroys the half-initialized clone via iptfs_destroy_state(), splicing and freeing buffers owned by the original queue. The root-cause class is CWE-416 (use-after-free) with a resulting CWE-415 (double-free); the CWE field is unpopulated (N/A) in the source data. The fix reinitializes the clone's runtime state before publishing it through x->mode_data and moves the mode-callback module reference into clone_state().

RemediationAI

Vendor-released patch: update to a fixed Linux kernel build - 6.18.35, 7.0.12, or 7.1 per the EUVD data - or apply your distribution's backport containing kernel.org commits 9327252e, dfb9f6cb, or 7f83d174 (https://git.kernel.org/stable/c/9327252e04626d4bb02ca8c0c108fbe8eabf0c5a). Where immediate patching is not possible and IPsec IP-TFS is not required, avoid configuring SAs with IPTFS mode (do not set the iptfs xfrm mode on tunnels), which removes the vulnerable code path entirely at the cost of losing traffic-flow-security padding/aggregation. If IPTFS is required, restrict who can manipulate IPsec state by tightly limiting CAP_NET_ADMIN and avoiding SA migration workflows on affected kernels until patched; the trade-off is reduced flexibility for HA/mobility failover that relies on xfrm_state_migrate(). Confirm the exact fixed version shipped by your distribution before relying on the upstream tag numbers.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-63911 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63911

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code