PT-2026-64368 · Linux · Linux

CVE-2026-64253 · Published 2026-07-24 · Updated 2026-07-24

Mitre

In the Linux kernel, the following vulnerability has been resolved:

kernel/fork: clear PF BLOCK TS in copy process()

PF BLOCK TS is only set in blk time get ns() when current->plug is non-NULL, and blk finish plug() clears it via blk flush plug() before NULLing the plug pointer. copy process() breaks the invariant by inheriting PF BLOCK TS from the parent while resetting the child's plug to NULL.

Clear PF BLOCK TS alongside that assignment so callers can rely on "PF BLOCK TS set implies current->plug != NULL" and dereference current->plug unguarded.

Related Identifiers

CVE-2026-64253

Affected Products

Linux

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-64253 · Security Note
• https://git.kernel.org/stable/c/77bba61a20f1b3d206f4f90e10a7bb3cd90b9619 · Note
• https://git.kernel.org/stable/c/99e6c712cc300883b8cbf03347d5359ec1a4d6dd · Note
• https://git.kernel.org/stable/c/ee0801aceabdf583392477baf69a290b09448b8f · Note
• https://git.kernel.org/stable/c/fd38b75c4b43295b10d69772a46d1c74dbd6fc81 · Note