Out-of-bounds write in Linux kernel - CVE-2026-63799

Vulnerability details

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to an out-of-bounds write in mm_cid_schedout() via mm_cid_fixup_cpus_to_tasks() when handling a task with MM_CID_UNSET in the per-CPU to per-task fixup path. A local user can trigger task state transitions such as fork() or execve() during this window to corrupt kernel memory.

The issue occurs only in per-CPU CID mode during the window before the task's next schedule-in assigns a real CID, and the resulting corruption is a deterministic single-bit clear at a fixed offset rather than an arbitrary write.

Affected software

How to mitigate CVE-2026-63799

External References

• https://git.kernel.org/stable/c/8d32856fb72ba976d9c87ba405fd17e80419934c
• https://git.kernel.org/stable/c/de3ab9bd3133899efb92e4cd05ba4203e58fc0a3

Related Security Bulletins

• Out-of-bounds write in Linux kernel sched