{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.177-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.95-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.3-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  bpf: use kvfree() for replaced sysctl write buffer  proc_sys_call_handler() allocates its temporary sysctl buffer with kvzalloc() and passes it to __cgroup_bpf_run_filter_sysctl(). Since kvzalloc() may fall back to vmalloc() for large allocations, freeing that buffer with kfree() is wrong and can corrupt memory.  Use kvfree() to safely handle both kmalloc and kvzalloc()/vmalloc allocations.  The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc5.  Reproduced the bug based on v7.1-rc4 in a QEMU x86_64 guest booted with KASAN and CONFIG_FAILSLAB enabled. To exercise the replacement path, the test tree also included the accompanying fix for the stale ret == 1 check in __cgroup_bpf_run_filter_sysctl(). The reproducer confines failslab injections to the proc_sys_call_handler() range, uses stacktrace-depth=32, and injects fail-nth=1 while writing 8191 bytes to /proc/sys/kernel/domainname from a task in the target cgroup. Under that setup, fail-nth=1 triggered the fault:    BUG: unable to handle page fault for address: ffffeb0200024d48   #PF: supervisor read access in kernel mode   #PF: error_code(0x0000) - not-present page   PGD 0 P4D 0   Oops: Oops: 0000  SMP KASAN NOPTI   CPU: 2 UID: 0 PID: 209 Comm: repro_proc_sys_ Not tainted 7.1.0-rc4-00686-g97625979a5d4  PREEMPT(lazy)   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014   RIP: 0010:kfree+0x6e/0x510   ...   Call Trace:    \u003cTASK\u003e    ? __cgroup_bpf_run_filter_sysctl+0x626/0xc30    __cgroup_bpf_run_filter_sysctl+0x74d/0xc30    ? __pfx___cgroup_bpf_run_filter_sysctl+0x10/0x10    ? srso_return_thunk+0x5/0x5f    ? __kvmalloc_node_noprof+0x345/0x870    ? proc_sys_call_handler+0x250/0x480    ? srso_return_thunk+0x5/0x5f    proc_sys_call_handler+0x3a2/0x480    ? __pfx_proc_sys_call_handler+0x10/0x10    ? srso_return_thunk+0x5/0x5f    ? selinux_file_permission+0x39f/0x500    ? srso_return_thunk+0x5/0x5f    ? lock_is_held_type+0x9e/0x120    vfs_write+0x98e/0x1000    ...    \u003c/TASK\u003e  With this fix applied on top of the same test setup, rerunning the reproducer with fail-nth=1 yields no corresponding Oops reports.",
  "id": "DEBIAN-CVE-2026-63809",
  "modified": "2026-09-14T16:47:44.345843489Z",
  "published": "2026-07-19T12:16:53.757Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-63809"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-63809"
  ]
}