CVE-2026-46259

Summary

In the Linux kernel, the following vulnerability has been resolved:

procfs: fix missing RCU protection when reading real_parent in do_task_stat()

When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which leads to:

cpu 0 cpu 1

do_task_stat var = task->real_parent release_task call_rcu(delayed_put_task_struct) task_tgid_nr_ns(var) rcu_read_lock <— Too late to protect task->real_parent! task_pid_ptr <— UAF! rcu_read_unlock

This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add proper RCU protection for accessing task->real_parent.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux06fffb1267c9d986687b69d74a46ee332a50575e < fefa0fcd78be465b7ad4c497fa6ec90d64194c04affected
LinuxLinux06fffb1267c9d986687b69d74a46ee332a50575e < c93a33f28f915d446eea6fb3f0e1def0b3af1982affected
LinuxLinux06fffb1267c9d986687b69d74a46ee332a50575e < 1c8dc5b5517546c68ffae40b948336122bb61306affected
LinuxLinux06fffb1267c9d986687b69d74a46ee332a50575e < 0e64bd46a04a4fd61279aca9f53a664e9e5f7e7eaffected
LinuxLinux06fffb1267c9d986687b69d74a46ee332a50575e < 73ec7c96601d61d52310c659145bb06d933a0fa6affected
LinuxLinux06fffb1267c9d986687b69d74a46ee332a50575e < 4f9ae386861e280b7631ca252f798d25575627eeaffected
LinuxLinux06fffb1267c9d986687b69d74a46ee332a50575e < dd8b13cb4ff1a4545a214ed897fdf2bc341155b6affected
LinuxLinux06fffb1267c9d986687b69d74a46ee332a50575e < 76149d53502cf17ef3ae454ff384551236fba867affected
LinuxLinux2.6.26affected
LinuxLinux0 < 2.6.26unaffected
LinuxLinux5.10.252 <= 5.10.*unaffected
LinuxLinux5.15.202 <= 5.15.*unaffected
LinuxLinux6.1.165 <= 6.1.*unaffected
LinuxLinux6.6.128 <= 6.6.*unaffected
LinuxLinux6.12.75 <= 6.12.*unaffected
LinuxLinux6.18.14 <= 6.18.*unaffected
LinuxLinux6.19.4 <= 6.19.*unaffected
LinuxLinux7.0 <= *unaffected

Weaknesses

References