CVE-2026-63835: linux

CVSS: UnknownAwaiting analysis
AliasesUBUNTU-CVE-2026-63835DEBIAN-CVE-2026-63835
Published 19-07-2026Last modified 17-08-2026
Open JSON

Vulnerability summary

CVE-2026-63835 is a vulnerability in linux with no CVSS score yet. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.5% of scored vulnerabilities.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
0.17%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 20 · Related 17
MGASA-2026-0312OPENSUSE-SU-2026:11339-1USN-8726-1USN-8726-2USN-8726-3USN-8726-4

Timeline

  1. 19-07-2026
    PublishedVulnerability first disclosed.
  2. 17-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: batman-adv: v: prevent OGM aggregation on disabled hardif When an interface gets disabled, the worker is correctly disabled by batadv_hardif_disable_interface() -> ... -> batadv_v_ogm_iface_disable(). In this process, the skb aggr_list is also freed. But batadv_v_ogm_send_meshif() can still queue new skbs (via batadv_v_ogm_queue_on_if()) to the aggr_list. This will only stop after all cores can no longer find the RCU protected list of hard interfaces. These queued skbs will never be freed or consumed by batadv_v_ogm_aggr_work. The batadv_v_ogm_iface_disable() function must block batadv_v_ogm_queue_on_if() to avoid leak of skbs.

CVSS metrics

Risk metrics not yet published.

EPSS trend

Probability

0.17%

Chance of exploitation in the next 30 days

Percentile

7%

Versus all other CVEs

30-day change

0.00 pp

From 0.17% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.17%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu165 products
  • linuxAll versions (No fix recorded) | < 5.15.0-198.208 | < 6.8.0-147.147 | < 7.0.0-31.31
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1117.124 | < 6.8.0-1067.70 | < 7.0.0-1012.12
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian1 product
  • linux< 6.1.177-1 | < 6.12.95-1 | < 7.1.3-1
Linux1 product
  • linux≥ f89255a02f1d75d8e1b9d1c31435fcb64840cb2a, < d462ced79dd430200cf888984e8005da77fc810b | ≥ f89255a02f1d75d8e1b9d1c31435fcb64840cb2a, < f79deaaf822ab0ee2424cf28781f9ab91576bea3 | ≥ f89255a02f1d75d8e1b9d1c31435fcb64840cb2a, < d3569327fc7395b2b0461a0a0cb77a0bb74786c0 | ≥ f89255a02f1d75d8e1b9d1c31435fcb64840cb2a, < 97644fdaaf6446ffbe182c5eb804fceb5b1a51b7 | ≥ f89255a02f1d75d8e1b9d1c31435fcb64840cb2a, < f04dde74399431fb07abbdd9cd5d0ed624771d04 | ≥ f89255a02f1d75d8e1b9d1c31435fcb64840cb2a, < 3d4548c96d6f21ac1a9b06c5f82f3ef439c87023 | ≥ f89255a02f1d75d8e1b9d1c31435fcb64840cb2a, < 86ab6b6fb5b82163bf6c45780bb72150021d7349 | ≥ f89255a02f1d75d8e1b9d1c31435fcb64840cb2a, < d11c00b95b2a3b3934007fc003dccc6fdcc061ad | 5.4

3 vendors · 167 products

References

31 links
Show all 31 references