Race condition in Linux kernel - CVE-2026-63865
Published: July 20, 2026
Vulnerability identifier: #VU138787
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-63865
CWE-ID: CWE-362
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper synchronization in sleepable bpf lsm hooks in kernel/bpf/bpf_lsm.c when executing the task_to_inode hook from rcu read-side critical sections. A local user can trigger the vulnerable hook to cause a denial of service.
The issue involves sleepable lsm programs being used with a hook that is invoked under rcu_read_lock().
How to mitigate CVE-2026-63865
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/0d918263c9bfc86078edb2e2f7302a0c6ce42b7c
- https://git.kernel.org/stable/c/26b380a3ca0b605fd8860995ed6a208f276dd316
- https://git.kernel.org/stable/c/281f2a214565a5cbf8b7355a65738d80bd19b8c5
- https://git.kernel.org/stable/c/452a927cddcd67478d030e646f41cb904a93156f
- https://git.kernel.org/stable/c/989f1b93907de1753a814996222da375f07e579b
- https://git.kernel.org/stable/c/beaf0e96b1da74549a6cabd040f9667d83b2e97e
- https://git.kernel.org/stable/c/f0fc2a9828171205244a28013f02889f50b71c9f