CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links)

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-25 · updated 2026-10-19
Weakness: CWE-362

Description

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptrace_may_access() with exec_update_lock (FD links) proc_pid_get_link() and proc_pid_readlink() currently look up the task from the pid once, then do the ptrace access check on that task, then look up the task from the pid a second time to do the actual access. That's racy in several ways. To fix it, pass the task to the ->proc_get_link() handler, and instead of proc_fd_access_allowed(), introduce a new helper call_proc_get_link() that looks up and locks the task, does the access check, and calls ->proc_get_link().

Affected products

Linux kernel: from 2.6.18 before 5.10.261; from 5.11 before 5.15.212; from 5.16 before 6.1.178; from 6.2 before 6.6.145; from 6.7 before 6.12.97; from 6.13 before 6.18.40 — fixed in 5.10.261, 5.15.212, 6.1.178, 6.12.97, 6.18.40, 6.6.145

How to fix

Upgrade to a fixed version: Linux kernel 5.10.261, 5.15.212, 6.1.178, 6.12.97. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-64375 or the next vulnerability affects your stack