Executive brief
A vulnerability in the Linux kernel's process information system (procfs) could allow unauthorized access to sensitive process details. This occurs because certain system checks were not properly synchronized, potentially leading to information leaks about running applications. An attacker with local access could exploit this to gather data that should be restricted to privileged users.
Technical details
A race condition exists in the Linux kernel's procfs implementation where ptrace_may_access() is called without the protection of exec_update_lock. This affects multiple functions including do_task_stat(), proc_pid_wchan(), and namespace-related links. The lack of proper locking during credential or memory management updates can allow a local attacker to bypass intended access restrictions and leak sensitive process information. The fix involves ensuring exec_update_lock is held during these checks or transitioning to mm_access() which handles the necessary synchronization. Affected files include fs/proc/array.c, fs/proc/base.c, and fs/proc/namespaces.c.
Affected products
- Linux Linux Kernel f83ce3e6b02d5e48b3a43b001390e2b58820389d to 6650527444dadc63d84aa939d14ecba4fadb2f69
Timeline
- 2026-05-18: disclosed: Initial patch submitted by Jann Horn
- 2026-07-24: patched: Patch committed to stable tree
- 2026-07-25: advisory: CVE-2026-64371 published
References
- https://git.kernel.org/stable/c/4bfe8c481846cee52473a2f7d7b30ee8e6749fc4
- https://git.kernel.org/stable/c/6650527444dadc63d84aa939d14ecba4fadb2f69
- https://git.kernel.org/stable/c/7456ae990a9738962b33146916fabca62ae3d4e0
- https://git.kernel.org/stable/c/ae1e630bcaac739f625822078edbaea98366930d
- https://git.kernel.org/stable/c/bb43679356f1f2a4c6b1c88aec4f021e5b5c74e9
- https://git.kernel.org/stable/c/c1cfd63326f5d09999134e9052c353faf738286e
- https://git.kernel.org/stable/c/d54f14655fd7d7b293698a8b6918563c4c0465e7