CVE-2026-63865 (GCVE-0-2026-63865)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:04 – Updated: 2026-08-05 12:36
VLAI
Title
bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks bpf_lsm_task_to_inode() is called under rcu_read_lock() and bpf_lsm_inet_conn_established() is called from softirq context, so neither hook can be used by sleepable LSM programs.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 423f16108c9d832bd96059d5c882c8ef6d76eb96 , < 452a927cddcd67478d030e646f41cb904a93156f (git)
Affected: 423f16108c9d832bd96059d5c882c8ef6d76eb96 , < f0fc2a9828171205244a28013f02889f50b71c9f (git)
Affected: 423f16108c9d832bd96059d5c882c8ef6d76eb96 , < 26b380a3ca0b605fd8860995ed6a208f276dd316 (git)
Affected: 423f16108c9d832bd96059d5c882c8ef6d76eb96 , < 0d918263c9bfc86078edb2e2f7302a0c6ce42b7c (git)
Affected: 423f16108c9d832bd96059d5c882c8ef6d76eb96 , < 281f2a214565a5cbf8b7355a65738d80bd19b8c5 (git)
Affected: 423f16108c9d832bd96059d5c882c8ef6d76eb96 , < 989f1b93907de1753a814996222da375f07e579b (git)
Affected: 423f16108c9d832bd96059d5c882c8ef6d76eb96 , < beaf0e96b1da74549a6cabd040f9667d83b2e97e (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.11
Unaffected: 0 , < 5.11 (semver)
Unaffected: 5.15.209 , ≤ 5.15.* (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.141 , ≤ 6.6.* (semver)
Unaffected: 6.12.91 , ≤ 6.12.* (semver)
Unaffected: 6.18.33 , ≤ 6.18.* (semver)
Unaffected: 7.0.10 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/bpf_lsm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "452a927cddcd67478d030e646f41cb904a93156f",
              "status": "affected",
              "version": "423f16108c9d832bd96059d5c882c8ef6d76eb96",
              "versionType": "git"
            },
            {
              "lessThan": "f0fc2a9828171205244a28013f02889f50b71c9f",
              "status": "affected",
              "version": "423f16108c9d832bd96059d5c882c8ef6d76eb96",
              "versionType": "git"
            },
            {
              "lessThan": "26b380a3ca0b605fd8860995ed6a208f276dd316",
              "status": "affected",
              "version": "423f16108c9d832bd96059d5c882c8ef6d76eb96",
              "versionType": "git"
            },
            {
              "lessThan": "0d918263c9bfc86078edb2e2f7302a0c6ce42b7c",
              "status": "affected",
              "version": "423f16108c9d832bd96059d5c882c8ef6d76eb96",
              "versionType": "git"
            },
            {
              "lessThan": "281f2a214565a5cbf8b7355a65738d80bd19b8c5",
              "status": "affected",
              "version": "423f16108c9d832bd96059d5c882c8ef6d76eb96",
              "versionType": "git"
            },
            {
              "lessThan": "989f1b93907de1753a814996222da375f07e579b",
              "status": "affected",
              "version": "423f16108c9d832bd96059d5c882c8ef6d76eb96",
              "versionType": "git"
            },
            {
              "lessThan": "beaf0e96b1da74549a6cabd040f9667d83b2e97e",
              "status": "affected",
              "version": "423f16108c9d832bd96059d5c882c8ef6d76eb96",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/bpf_lsm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.141",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks\n\nbpf_lsm_task_to_inode() is called under rcu_read_lock() and\nbpf_lsm_inet_conn_established() is called from softirq context, so\nneither hook can be used by sleepable LSM programs."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires loading and attaching a sleepable BPF LSM program via bpf() syscalls; per kernel CNA guidance BPF subsystem issues are Local even though inet_conn_established fires during TCP receive processing.\nAC:L - Once a sleepable BPF LSM program is attached, the attacker reliably triggers the bug by making outbound TCP connections (inet_conn_established in softirq) or accessing /proc entries (task_to_inode under rcu_read_lock) without race-dependent conditions.\nPR:L - Loading BPF_PROG_TYPE_LSM programs requires CAP_BPF and CAP_PERFMON, both obtainable by an unprivileged user inside a user namespace (unshare -Ur) on typical Linux deployments with CONFIG_BPF_LSM enabled.\nUI:N - No victim user interaction is required; triggering occurs automatically from normal outbound TCP handshakes or /proc filesystem access after the sleepable BPF program is loaded.\nS:C - A container tenant with namespace CAP_BPF can load a sleepable BPF LSM on inet_conn_established or task_to_inode, and hook execution in host kernel softirq/RCU context can crash or corrupt the entire host, crossing the container-to-host security boundary.\nC:H - Executing sleepable BPF helpers (e.g. bpf_copy_from_user, GFP_KERNEL allocations) inside rcu_read_lock or softirq can corrupt kernel memory before detection, and such context violations are classifiable as exploitable memory-safety failures.\nI:H - Sleeping while holding TCP stack or RCU-protected locks can corrupt kernel data structures and potentially be leveraged for arbitrary kernel write or control-flow hijack, not merely a clean crash.\nA:H - Invoking might_sleep operations from softirq or RCU-critical sections reliably causes kernel BUG/oops/panic (\"sleeping function called from invalid context\"), producing complete host denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:36:41.333Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/452a927cddcd67478d030e646f41cb904a93156f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0fc2a9828171205244a28013f02889f50b71c9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/26b380a3ca0b605fd8860995ed6a208f276dd316"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d918263c9bfc86078edb2e2f7302a0c6ce42b7c"
        },
        {
          "url": "https://git.kernel.org/stable/c/281f2a214565a5cbf8b7355a65738d80bd19b8c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/989f1b93907de1753a814996222da375f07e579b"
        },
        {
          "url": "https://git.kernel.org/stable/c/beaf0e96b1da74549a6cabd040f9667d83b2e97e"
        }
      ],
      "title": "bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63865",
    "datePublished": "2026-07-19T14:04:51.215Z",
    "dateReserved": "2026-07-19T07:54:57.017Z",
    "dateUpdated": "2026-08-05T12:36:41.333Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63865",
      "date": "2026-09-21",
      "epss": "0.00127",
      "percentile": "0.02758"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/bpf_lsm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "452a927cddcd67478d030e646f41cb904a93156f",
                    "status": "affected",
                    "version": "423f16108c9d832bd96059d5c882c8ef6d76eb96",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f0fc2a9828171205244a28013f02889f50b71c9f",
                    "status": "affected",
                    "version": "423f16108c9d832bd96059d5c882c8ef6d76eb96",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "26b380a3ca0b605fd8860995ed6a208f276dd316",
                    "status": "affected",
                    "version": "423f16108c9d832bd96059d5c882c8ef6d76eb96",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0d918263c9bfc86078edb2e2f7302a0c6ce42b7c",
                    "status": "affected",
                    "version": "423f16108c9d832bd96059d5c882c8ef6d76eb96",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "281f2a214565a5cbf8b7355a65738d80bd19b8c5",
                    "status": "affected",
                    "version": "423f16108c9d832bd96059d5c882c8ef6d76eb96",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "989f1b93907de1753a814996222da375f07e579b",
                    "status": "affected",
                    "version": "423f16108c9d832bd96059d5c882c8ef6d76eb96",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "beaf0e96b1da74549a6cabd040f9667d83b2e97e",
                    "status": "affected",
                    "version": "423f16108c9d832bd96059d5c882c8ef6d76eb96",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/bpf_lsm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.11"
                  },
                  {
                    "lessThan": "5.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.209",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.175",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.141",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.91",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.33",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks\n\nbpf_lsm_task_to_inode() is called under rcu_read_lock() and\nbpf_lsm_inet_conn_established() is called from softirq context, so\nneither hook can be used by sleepable LSM programs."
          }
        ],
        "id": "CVE-2026-63865",
        "lastModified": "2026-07-27T17:44:23.777",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T15:16:53.400",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0d918263c9bfc86078edb2e2f7302a0c6ce42b7c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/26b380a3ca0b605fd8860995ed6a208f276dd316"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/281f2a214565a5cbf8b7355a65738d80bd19b8c5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/452a927cddcd67478d030e646f41cb904a93156f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/989f1b93907de1753a814996222da375f07e579b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/beaf0e96b1da74549a6cabd040f9667d83b2e97e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f0fc2a9828171205244a28013f02889f50b71c9f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-21T19:20:46+00:00",
      "cve": "CVE-2026-63865",
      "id": "CVE-2026-63865",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63865.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:47:14Z",
      "cve": "CVE-2026-63865",
      "id": "CVE-2026-63865",
      "initial_release_date": "2026-07-24T16:21:42Z",
      "product_status:known_affected": "423",
      "product_status:known_not_affected": "310",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63865",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63865.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.