What is CVE-2026-63858?

CVE-2026-63858 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10, affecting Linux kernel versions from 5.10.122 onward and patched in 7.0.10 and 7.1. CVE-2026-63858 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-63858?

CVE-2026-63858 has a CVSS score of 7.8 out of 10, rated High severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2026-63858?

Yes, CVE-2026-63858 has been patched. Fixed versions include 7.0.10 and 7.1. If you are running Linux kernel 5.10.122 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-63858 actively exploited?

CVE-2026-63858 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

CVE-2026-63858

High

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: add hook transactions for device deletions Restore the flag that indicates that the hook is going away, ie. NFT_HOOK_REMOVE, but add a new transaction object to track deletion of hooks without altering the basechain/flowtable hook_list during the preparation phase. The existing approach that moves the hook from the basechain/flowtable hook_list to transaction hook_list breaks netlink dump path readers of this RCU-protected list. It should be possible use an array for nft_trans_hook to store the deleted hooks to compact the representation but I am not expecting many hook object, specially now that wildcard support for devices is in place. Note that the nft_trans_chain_hooks() list contains a list of struct nft_trans_hook objects for DELCHAIN and DELFLOWTABLE commands, while this list stores struct nft_hook objects for NEWCHAIN and NEWFLOWTABLE. Note that new commands can be updated to use nft_trans_hook for consistency. This patch also adapts the event notification path to deal with the list of hook transactions.

Package Linux Kernel

Published 2026-07-19

Last modified 2026-07-27

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

7.8

out of 10

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected versions

Linux kernel versions 5.10.122, 5.15.47, 5.17.15, 5.18.4, 5.19 and later are affected. Fixed in 7.0.10, 7.1 and their respective stable series.

Affected from

≥ 5.10.122 ≥ 5.15.47 ≥ 5.17.15 ≥ 5.18.4 ≥ 5.19

Fixed in

✓ 7.0.10 7.0.x ✓ 7.1

References

2 total

Details

CVE ID CVE-2026-63858

Severity High

CVSS score 7.8 / 10

CVSS version 3.1

Published 2026-07-19

Modified 2026-07-27

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-63858?

CVE-2026-63858 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10 . It affects Linux kernel versions from 5.10.122 onward and has been patched in 7.0.10 and 7.1. CVE-2026-63858 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-63858?

CVE-2026-63858 has a CVSS score of 7.8 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2026-63858?

Yes. CVE-2026-63858 has been patched. Fixed versions include 7.0.10 and 7.1. If you are running Linux kernel 5.10.122 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-63858 actively exploited?

No. CVE-2026-63858 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.