PT-2026-46022 · Linux · Linux

Published 2026-06-03 · Updated 2026-06-03 · CVE-2026-46259

Mitre

In the Linux kernel, the following vulnerability has been resolved:

procfs: fix missing RCU protection when reading real parent in do task stat()

When reading /proc/[pid]/stat, do task stat() accesses task->real parent without proper RCU protection, which leads to:

cpu 0 cpu 1

---

do task stat var = task->real parent release task call rcu(delayed put task struct) task tgid nr ns(var) rcu read lock <--- Too late to protect task->real parent! task pid ptr <--- UAF! rcu read unlock

This patch uses task ppid nr ns() instead of task tgid nr ns() to add proper RCU protection for accessing task->real parent.

Related Identifiers

CVE-2026-46259

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-46259 · Security Note
• https://git.kernel.org/stable/c/c93a33f28f915d446eea6fb3f0e1def0b3af1982 · Note
• https://git.kernel.org/stable/c/73ec7c96601d61d52310c659145bb06d933a0fa6 · Note
• https://git.kernel.org/stable/c/1c8dc5b5517546c68ffae40b948336122bb61306 · Note
• https://git.kernel.org/stable/c/dd8b13cb4ff1a4545a214ed897fdf2bc341155b6 · Note
• https://git.kernel.org/stable/c/4f9ae386861e280b7631ca252f798d25575627ee · Note
• https://git.kernel.org/stable/c/76149d53502cf17ef3ae454ff384551236fba867 · Note
• https://git.kernel.org/stable/c/fefa0fcd78be465b7ad4c497fa6ec90d64194c04 · Note
• https://git.kernel.org/stable/c/0e64bd46a04a4fd61279aca9f53a664e9e5f7e7e · Note