CVE-2026-63808 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
exfat: fix potential use-after-free in exfat_find_dir_entry()
In exfat_find_dir_entry(), the buffer_head obtained from exfat_get_dentry() is released with brelse(bh) before the fall-through TYPE_EXTEND branch reads the directory entry through ep (which points into bh->b_data):
brelse(bh); if (entry_type == TYPE_EXTEND) {
... len = exfat_extract_uni_name(ep, entry_uniname); ... }
After brelse() drops our reference, nothing guarantees that the underlying page backing bh->b_data remains valid for the subsequent exfat_extract_uni_name() read. This is the same pattern fixed in commit fc961522ddbd ("exfat: Fix potential use after free in exfat_load_upcase_table()").
Move brelse(bh) so it runs after ep is no longer dereferenced on each branch.
Confirmed on QEMU x86_64 with CONFIG_KASAN=y + CONFIG_DEBUG_PAGEALLOC=y + CONFIG_PAGE_POISONING=y on linux-next, using a crafted exFAT image (long filename with same-hash collisions forcing the TYPE_EXTEND path). With a debug-only invalidate_bdev() inserted between brelse(bh) and the ep read to make the stale-deref window deterministic, the unpatched kernel faults:
BUG: KASAN: use-after-free in exfat_find_dir_entry+0x133b/0x15a0 BUG: unable to handle page fault for address: ffff88801a5fa0c2 Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI
RIP: 0010:exfat_find_dir_entry+0x1188/0x15a0
With this patch applied, the same instrumented harness completes cleanly under the same sanitizer stack. I have not reproduced a crash on an uninstrumented kernel under ordinary reclaim; the instrumented A/B establishes the lifetime violation and that the patch closes it, not an unaided triggerability claim.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability exists within the exFAT file system implementation of the Linux kernel where a use-after-free condition can occur in the exfat_find_dir_entry() function. This flaw arises from improper handling of buffer head references during directory entry processing, specifically when dealing with extended attribute entries. The issue manifests when the code releases a buffer head reference using brelse() before all potential code paths that might access data within that buffer have completed execution.
The technical flaw occurs due to a sequence where exfat_get_dentry() provides a buffer_head structure containing directory entry data, which is then immediately released with brelse(bh) before the TYPE_EXTEND branch can safely read from the entry pointer ep. This pointer references memory within bh->b_data which may no longer be valid after the buffer head release operation. The pattern mirrors another previously identified vulnerability in exfat_load_upcase_table() that was addressed through similar remediation techniques, demonstrating a consistent code pattern requiring careful buffer lifetime management.
This vulnerability falls under CWE-416, representing use-after-free conditions in memory management, and aligns with ATT&CK technique T1059.007 for execution through kernel modules. The operational impact extends beyond simple memory corruption as it represents an exploitable condition that could potentially lead to privilege escalation or system instability. The vulnerability is particularly concerning because it occurs during normal directory traversal operations and can be triggered through crafted exFAT filesystem images with specific filename characteristics, including long filenames that create hash collisions.
The fix implements proper ordering of buffer head release operations by moving brelse(bh) to execute after all code paths that might dereference the entry pointer ep have completed. This ensures that memory referenced by ep remains valid for the duration of all potential access patterns, including both regular and extended attribute entry processing branches. The patch maintains the same functional behavior while eliminating the race condition that allowed stale memory references. Testing confirmed the vulnerability through KASAN instrumentation on QEMU x86_64 with debug configurations, demonstrating that without the fix, the kernel would fault with use-after-free errors during directory entry processing operations.
The remediation approach addresses the fundamental issue of buffer lifetime management in kernel space file system code where multiple execution paths access the same memory region. This pattern requires careful consideration of reference counting and memory validity guarantees, particularly when dealing with cached data structures that may be released before all potential consumers have finished accessing them. The solution demonstrates a defensive programming practice essential for maintaining kernel stability and security in file system implementations.
This vulnerability highlights the importance of rigorous memory management review in kernel subsystems, particularly those handling file system metadata operations where buffer lifetime can span multiple conditional execution paths. The fix reinforces proper resource management principles that prevent memory safety violations while maintaining performance characteristics of the exFAT implementation. The pattern identified here is relevant across similar file system implementations and underscores the need for systematic code reviews focusing on buffer reference semantics and memory access ordering in kernel space operations.
The vulnerability represents a classic example of how seemingly simple memory management operations can create complex security implications when multiple execution paths share the same resource. The fix ensures that all potential consumers of directory entry data have completed their access before releasing associated buffers, preventing both immediate crashes and potential exploitation scenarios that could leverage the use-after-free condition for privilege escalation or denial of service attacks against systems running exFAT file systems.