CVE-2026-63864 bpf: Propagate error from visit_tailcall_insn
The Linux kernel BPF verifier fails to propagate errors from tail call instruction visits, potentially leading to undefined behavior or incorrect verification states.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63864?
CVE-2026-63864 is a high-severity vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Propagate error from visit_tailcall_insn
Commit e40f5a6bf88a ("bpf: correct stack liveness for tail calls") added visit_tailcall_insn() but did not check its return value.
Which versions are affected by CVE-2026-63864?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-63864?
Apply the vendor's patch.
Is CVE-2026-63864 being exploited?
There is no known exploitation of CVE-2026-63864 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2026-63864, GHSA-xw7r-6m22-6cfw, UBUNTU-CVE-2026-63864.