PT-2026-61182 · Linux · Linux

CVE-2026-63865 · Published 2026-07-19 · Updated 2026-07-19

Mitre

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

bpf: Drop task to inode and inet conn established from lsm sleepable hooks

bpf lsm task to inode() is called under rcu read lock() and bpf lsm inet conn established() is called from softirq context, so neither hook can be used by sleepable LSM programs.

Fix

Related Identifiers

CVE-2026-63865

Affected Products

Linux

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-63865 · Security Note
• https://git.kernel.org/stable/c/452a927cddcd67478d030e646f41cb904a93156f · Note
• https://git.kernel.org/stable/c/f0fc2a9828171205244a28013f02889f50b71c9f · Note
• https://git.kernel.org/stable/c/26b380a3ca0b605fd8860995ed6a208f276dd316 · Note
• https://git.kernel.org/stable/c/0d918263c9bfc86078edb2e2f7302a0c6ce42b7c · Note
• https://git.kernel.org/stable/c/989f1b93907de1753a814996222da375f07e579b · Note
• https://git.kernel.org/stable/c/beaf0e96b1da74549a6cabd040f9667d83b2e97e · Note
• https://git.kernel.org/stable/c/281f2a214565a5cbf8b7355a65738d80bd19b8c5 · Note