Executive brief
A vulnerability was identified in the Linux kernel's process creation mechanism. When a new process is created, it could incorrectly inherit certain internal status flags from its parent process that do not match its actual state. This inconsistency could lead to system instability or crashes if the kernel attempts to access memory based on those incorrect flags.
Technical details
A logic error exists in kernel/fork.c within the copy_process() function. The PF_BLOCK_TS flag, which indicates that a block plug is active, was being inherited by child processes even though the child's plug pointer is initialized to NULL. This breaks the kernel invariant that PF_BLOCK_TS being set implies a non-NULL plug pointer. An attacker or a specific sequence of system calls could trigger a scenario where the kernel attempts to dereference the NULL plug pointer unguarded, leading to a kernel oops or crash. The issue has been resolved by explicitly clearing the PF_BLOCK_TS flag during process creation.
Affected products
- Linux Linux Kernel 6.9 to 7.1.3
Timeline
- 2026-06-16: patched: Initial fix committed to mainline kernel
- 2026-07-24: disclosed: CVE published