PT-2026-61115 · Linux · Linux Kernel

CVE-2026-63799 · Published 2026-07-19 · Updated 2026-07-19

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds write occurs in the scheduler mmcid fixup path during the execution of the mm cid fixup cpus to tasks() function. In per-CPU CID mode, a task that has been newly forked or executed may have its mm cid.cid variable set to MM CID UNSET. If the cid in transit() check passes, the system converts this value to MM CID UNSET | MM CID TRANSIT. Subsequently, the mm cid schedout() function passes this value to clear bit(), using MM CID UNSET as the bit number. Since MM CID UNSET is a fixed sentinel value (BIT 31) and the CID bitmap is only as wide as the number of possible CPUs, this results in a deterministic out-of-bounds bit-clear operation at a fixed offset of 256 MiB past the bitmap base. This leads to memory corruption of a single bit in unpredictable kernel memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-63799

Affected Products

Linux Kernel

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-63799 · Security Note
• https://git.kernel.org/stable/c/8d32856fb72ba976d9c87ba405fd17e80419934c · Note
• https://twitter.com/VulmonFeeds/status/2078922761817264438 · Twitter Post
• https://git.kernel.org/stable/c/de3ab9bd3133899efb92e4cd05ba4203e58fc0a3 · Note