CVE-2026-64375

Awaiting Analysis Awaiting Analysis - Queue

proc: Race Condition in PID Link Access via ptrace_may_access

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptrace_may_access() with exec_update_lock (FD links) proc_pid_get_link() and proc_pid_readlink() currently look up the task from the pid once, then do the ptrace access check on that task, then look up the task from the pid a second time to do the actual access. That's racy in several ways. To fix it, pass the task to the ->proc_get_link() handler, and instead of proc_fd_access_allowed(), introduce a new helper call_proc_get_link() that looks up and locks the task, does the access check, and calls ->proc_get_link().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64375

EUVD

EUVD-2026-48919

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition in proc_pid_get_link() and proc_pid_readlink() functions. These functions currently look up a task twice from a PID: once for a ptrace access check and again for the actual access. This creates a security risk as the task could change between lookups, potentially allowing unauthorized access.

Detection Guidance

This vulnerability is specific to the Linux kernel's proc filesystem handling. Detection requires checking if your kernel version includes the vulnerable code path. Use uname -a to check your kernel version and compare it against patched versions. Look for kernel versions prior to the fix date (2026-07-25).

Commands to check kernel version: uname -a, cat /proc/version. If your kernel is older than the patched version, the system may be vulnerable.

Impact Analysis

This vulnerability could allow an attacker to exploit the race condition to gain unauthorized access to sensitive information or perform actions they shouldn't be able to. This might lead to data leaks, privilege escalation, or other malicious activities depending on the system's configuration and the attacker's goals.

Compliance Impact

This vulnerability in the Linux kernel involves a race condition in proc_pid_get_link() and proc_pid_readlink() that could allow unauthorized access to sensitive process information. While not directly tied to GDPR or HIPAA, such vulnerabilities could potentially lead to unauthorized data exposure, which may impact compliance with these regulations by compromising data confidentiality and integrity.

Mitigation Strategies

Immediately update your Linux kernel to the latest stable version that includes the fix. This typically involves running your package manager's update command (e.g., apt upgrade, yum update, or dnf upgrade).

After updating, reboot the system to ensure the new kernel is active. Monitor vendor advisories for additional mitigation steps if kernel updates are not immediately available.

Hi! I’m here to help you understand CVE-2026-64375. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70