Linux Kernel up to 6.18.32/7.0.9 Airoha airoha_qdma_cleanup_tx_queue Remote Code Execution

Summaryinfo

A vulnerability categorized as very critical has been discovered in Linux Kernel up to 6.18.32/7.0.9. This impacts the function airoha_qdma_cleanup_tx_queue of the component Airoha. Such manipulation leads to Remote Code Execution. This vulnerability is traded as CVE-2026-63859. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.18.32/7.0.9 and classified as very critical. Affected by this issue is the function airoha_qdma_cleanup_tx_queue of the component Airoha. The manipulation with an unknown input leads to a remote code execution vulnerability. Impacted is confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue() Similar to airoha_qdma_cleanup_rx_queue(), reset DMA TX descriptors in airoha_qdma_cleanup_tx_queue routine. Moreover, reset TX_DMA_IDX to TX_CPU_IDX to notify the NIC the QDMA TX ring is empty.

The advisory is shared for download at git.kernel.org. This vulnerability is handled as CVE-2026-63859 since 07/19/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/20/2026).

The vulnerability scanner Nessus provides a plugin with the ID 327887 (Linux Distros Unpatched Vulnerability : CVE-2026-63859), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.18.33 or 7.0.10 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (327887). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.18.8
• 6.18.9
• 6.18.10
• 6.18.11
• 6.18.12
• 6.18.13
• 6.18.14
• 6.18.15
• 6.18.16
• 6.18.17
• 6.18.18
• 6.18.19
• 6.18.20
• 6.18.21
• 6.18.22
• 6.18.23
• 6.18.24
• 6.18.25
• 6.18.26
• 6.18.27
• 6.18.28
• 6.18.29
• 6.18.30
• 6.18.31
• 6.18.32
• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.0.7
• 7.0.8
• 7.0.9

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion