Use-After-Free Vulnerability in Linux Kernel Affecting exFAT File System

CVE-2026-63808

What is CVE-2026-63808?

In the Linux kernel, a potential use-after-free vulnerability in the exFAT file system has been identified, specifically in the function exfat_find_dir_entry(). The vulnerability arises when the buffer_head, obtained from exfat_get_dentry(), is prematurely released, leaving uncertainty about the validity of the data access that follows. This issue can lead to reading from a freed buffer, which in certain crafted scenarios can cause system faults and crashes. The patched approach ensures the buffer is only released after all necessary read operations are completed, closing the potential exploit window.

References