What is the CVSS score of CVE-2026-63954?

CVE-2026-63954 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-63954?

CVE-2026-63954 is a local denial-of-service vulnerability in the Linux kernel's HPFS driver that affects only systems with mounted HPFS filesystems-a legacy storage format used by a small subset of…. A patch is available.

How to fix or mitigate CVE-2026-63954?

Within 24 hours: determine whether your Linux infrastructure includes any systems with HPFS filesystems mounted, as this vulnerability only applies to that narrow use case. Within 7 days: if HPFS systems exist, schedule kernel updates to patched versions (5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, or 7.1 depending on your kernel release branch) during a maintenance window. Within 30 days: complete the patching of all affected systems and validate that HPFS filesystem services resume normally after the update.

Linux Kernel CVE-2026-63954

EUVD-2026-45727 HIGH

2026-07-19 Linux

GHSA-67c6-765v-26g2

Denial Of Service Linux

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.5 MEDIUM

Uninitialized-buffer-head release causes a kernel crash (A:H) with no confidentiality or integrity impact; requires local mount of a crafted HPFS image, so AV:L and PR:L.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:32 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

7.8 (HIGH)

Patch available

Jul 19, 2026 - 17:19 EUVD

CVE Published

Jul 19, 2026 - 14:55 cve.org

HIGH 7.8

CVE Published

Jul 19, 2026 - 14:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

hpfs: fix a crash if hpfs_map_dnode_bitmap fails

If hpfs_map_dnode_bitmap fails, the code would call hpfs_brelse4 on uninitialized quad buffer head, causing a crash.

AnalysisAI

Local denial-of-service in the Linux kernel's HPFS (High Performance File System) driver allows a crash when hpfs_map_dnode_bitmap fails and the code subsequently calls hpfs_brelse4 on an uninitialized quad buffer head. Affected are Linux kernels prior to the fixed stable releases (5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1) when an HPFS filesystem is mounted. There is no public exploit identified at time of analysis, KEV does not list it, and EPSS is very low (0.21%), consistent with a niche legacy-filesystem bug rather than a broadly weaponizable flaw.

Technical ContextAI

HPFS is the OS/2 High Performance File System, supported in Linux via the legacy fs/hpfs driver. The bug is a use-of-uninitialized-resource / error-path handling defect (functionally CWE-908/CWE-457; the input lists CWE as N/A): when hpfs_map_dnode_bitmap() fails to map the dnode bitmap, the function proceeds to call hpfs_brelse4() on a struct quad_buffer_head that was never populated, dereferencing garbage/uninitialized pointers and crashing the kernel. The CPE data identifies the affected product as cpe:2.3:a:linux:linux:*, i.e. the mainline/stable Linux kernel; the defect is confined to the HPFS module and only reachable when such a filesystem is parsed. The fix ensures the error path does not release an uninitialized buffer head.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, or 7.1 (or later) matching your kernel series - as shipped by your distribution. The fixes are the kernel.org stable commits listed under https://git.kernel.org/stable/c/ (e.g. 010b08084000ef018f1a8de5197087f3b91d8cfe, d98d8562b3284b5a5c8eb67e71b794508e46e288, 7c58c55a2a16f7274772507bd1637be609351b4f). Where immediate patching is not possible, a targeted compensating control is to prevent untrusted HPFS mounts: blacklist the hpfs module (add 'blacklist hpfs' and 'install hpfs /bin/true' in modprobe.d) so crafted images cannot load the driver - trade-off is loss of the ability to read legitimate OS/2 HPFS media, which is negligible in modern environments. Additionally, disable automounting of removable media (e.g. udisks/USB automount policies) to remove the unprivileged-insertion path, at the cost of user convenience for USB devices.

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-63954 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63954

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code