{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-63865","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T07:54:57.017Z","datePublished":"2026-07-19T14:04:51.215Z","dateUpdated":"2026-08-05T12:36:41.333Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:36:41.333Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks\n\nbpf_lsm_task_to_inode() is called under rcu_read_lock() and\nbpf_lsm_inet_conn_established() is called from softirq context, so\nneither hook can be used by sleepable LSM programs."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires loading and attaching a sleepable BPF LSM program via bpf() syscalls; per kernel CNA guidance BPF subsystem issues are Local even though inet_conn_established fires during TCP receive processing.\nAC:L - Once a sleepable BPF LSM program is attached, the attacker reliably triggers the bug by making outbound TCP connections (inet_conn_established in softirq) or accessing /proc entries (task_to_inode under rcu_read_lock) without race-dependent conditions.\nPR:L - Loading BPF_PROG_TYPE_LSM programs requires CAP_BPF and CAP_PERFMON, both obtainable by an unprivileged user inside a user namespace (unshare -Ur) on typical Linux deployments with CONFIG_BPF_LSM enabled.\nUI:N - No victim user interaction is required; triggering occurs automatically from normal outbound TCP handshakes or /proc filesystem access after the sleepable BPF program is loaded.\nS:C - A container tenant with namespace CAP_BPF can load a sleepable BPF LSM on inet_conn_established or task_to_inode, and hook execution in host kernel softirq/RCU context can crash or corrupt the entire host, crossing the container-to-host security boundary.\nC:H - Executing sleepable BPF helpers (e.g. bpf_copy_from_user, GFP_KERNEL allocations) inside rcu_read_lock or softirq can corrupt kernel memory before detection, and such context violations are classifiable as exploitable memory-safety failures.\nI:H - Sleeping while holding TCP stack or RCU-protected locks can corrupt kernel data structures and potentially be leveraged for arbitrary kernel write or control-flow hijack, not merely a clean crash.\nA:H - Invoking might_sleep operations from softirq or RCU-critical sections reliably causes kernel BUG/oops/panic (\"sleeping function called from invalid context\"), producing complete host denial of service."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/bpf/bpf_lsm.c"],"versions":[{"version":"423f16108c9d832bd96059d5c882c8ef6d76eb96","lessThan":"452a927cddcd67478d030e646f41cb904a93156f","status":"affected","versionType":"git"},{"version":"423f16108c9d832bd96059d5c882c8ef6d76eb96","lessThan":"f0fc2a9828171205244a28013f02889f50b71c9f","status":"affected","versionType":"git"},{"version":"423f16108c9d832bd96059d5c882c8ef6d76eb96","lessThan":"26b380a3ca0b605fd8860995ed6a208f276dd316","status":"affected","versionType":"git"},{"version":"423f16108c9d832bd96059d5c882c8ef6d76eb96","lessThan":"0d918263c9bfc86078edb2e2f7302a0c6ce42b7c","status":"affected","versionType":"git"},{"version":"423f16108c9d832bd96059d5c882c8ef6d76eb96","lessThan":"281f2a214565a5cbf8b7355a65738d80bd19b8c5","status":"affected","versionType":"git"},{"version":"423f16108c9d832bd96059d5c882c8ef6d76eb96","lessThan":"989f1b93907de1753a814996222da375f07e579b","status":"affected","versionType":"git"},{"version":"423f16108c9d832bd96059d5c882c8ef6d76eb96","lessThan":"beaf0e96b1da74549a6cabd040f9667d83b2e97e","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/bpf/bpf_lsm.c"],"versions":[{"version":"5.11","status":"affected"},{"version":"0","lessThan":"5.11","status":"unaffected","versionType":"semver"},{"version":"5.15.209","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.175","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.141","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.91","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.33","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.10","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.209"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.1.175"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.6.141"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.12.91"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.18.33"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"7.0.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"7.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/452a927cddcd67478d030e646f41cb904a93156f"},{"url":"https://git.kernel.org/stable/c/f0fc2a9828171205244a28013f02889f50b71c9f"},{"url":"https://git.kernel.org/stable/c/26b380a3ca0b605fd8860995ed6a208f276dd316"},{"url":"https://git.kernel.org/stable/c/0d918263c9bfc86078edb2e2f7302a0c6ce42b7c"},{"url":"https://git.kernel.org/stable/c/281f2a214565a5cbf8b7355a65738d80bd19b8c5"},{"url":"https://git.kernel.org/stable/c/989f1b93907de1753a814996222da375f07e579b"},{"url":"https://git.kernel.org/stable/c/beaf0e96b1da74549a6cabd040f9667d83b2e97e"}],"title":"bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks","x_generator":{"engine":"bippy-1.2.0"}}}}