VulnerabilityPublished 24 Jul 2026Updated 6 Nov 2026

CVE-2026-64253: Linux kernel · kernel/fork: clear PF_BLOCK_TS in copy_process()

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in fd38b75c4b43295b10d69772a46d1c74dbd6fc81 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 16:51 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in fd38b75c4b43295b10d69772a46d1c74dbd6fc81, ee0801aceabdf583392477baf69a290b09448b8f, 99e6c712cc300883b8cbf03347d5359ec1a4d6dd +1

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to fd38b75c4b43295b10d69772a46d1c74dbd6fc81, ee0801aceabdf583392477baf69a290b09448b8f, 99e6c712cc300883b8cbf03347d5359ec1a4d6dd or 77bba61a20f1b3d206f4f90e10a7bb3cd90b9619.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 06b23f92af87a84d70881b2ecaa72e00f7838264, < fd38b75c4b43295b10d69772a46d1c74dbd6fc81	Fixed in fd38b75c4b43295b10d69772a46d1c74dbd6fc81
LinuxLinux	Affected ≥ 06b23f92af87a84d70881b2ecaa72e00f7838264, < ee0801aceabdf583392477baf69a290b09448b8f	Fixed in ee0801aceabdf583392477baf69a290b09448b8f
LinuxLinux	Affected ≥ 06b23f92af87a84d70881b2ecaa72e00f7838264, < 99e6c712cc300883b8cbf03347d5359ec1a4d6dd	Fixed in 99e6c712cc300883b8cbf03347d5359ec1a4d6dd
LinuxLinux	Affected ≥ 06b23f92af87a84d70881b2ecaa72e00f7838264, < 77bba61a20f1b3d206f4f90e10a7bb3cd90b9619	Fixed in 77bba61a20f1b3d206f4f90e10a7bb3cd90b9619
LinuxLinux	Affected =6.9	Fixed in–

AI-suggested

A fix is available and has been applied in the Linux kernel versions identified by the fixed commit hashes. Users and administrators should update to a Linux kernel version that includes these fixes to resolve the issue. No additional mitigation steps are indicated.

Description

A vulnerability in the Linux kernel's process copying function (copy_process) was identified where the PF_BLOCK_TS flag was incorrectly inherited by child processes. This flag should only be set when the current process's plug pointer is non-NULL, but copy_process() inherited PF_BLOCK_TS without ensuring the plug pointer was valid, breaking this invariant. The issue was fixed by clearing PF_BLOCK_TS when resetting the child's plug pointer to NULL, ensuring callers can safely assume that PF_BLOCK_TS implies a non-NULL plug pointer.

Impact

The vulnerability could lead to kernel instability or crashes due to dereferencing a NULL pointer when PF_BLOCK_TS is set but the plug pointer is NULL. This affects kernel internal process management and could impact system reliability. There is no indication of exploitation in the wild or direct security compromise from this flaw.

Summary

The Linux kernel vulnerability CVE-2026-64253 involves the improper handling of the PF_BLOCK_TS flag in the copy_process() function during process creation. PF_BLOCK_TS is set only when the current process's plug pointer is non-NULL, but copy_process() inherited this flag from the parent process while resetting the child's plug pointer to NULL, violating the expected invariant. This could cause kernel code to dereference a NULL plug pointer if it relied on PF_BLOCK_TS being set. The fix clears PF_BLOCK_TS alongside resetting the child's plug pointer to NULL, restoring the invariant and preventing potential kernel instability or crashes.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 16:51 UTC

Technical details

References

Community reviews

Related threats