VulnerabilityPublished 6 Aug 2026Updated 11 Sep 2026

CVE-2026-64596: Linux kernel · libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()

Affects Linux kernelSource GCVE Database

Not known to be exploited · fixed in 7.0.0-1012.12~24.04.1 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 12:55 UTC

Severity

Medium

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 7.0.0-1012.12~24.04.1, 7.0.0-1011.11~24.04.1, 7.0.0-31.31~24.04.1 +7

Exploitation evidence

Disclosed: evidence found.
CVE published 6 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-99j8-6mjv-5hff

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
Ubuntu 26.04 LTSlinux`pkg:deb/ubuntu/linux?arch=source&distro=resolute`Other threats	Affected <7.0.0-31.31	Fixed in 7.0.0-31.31
Ubuntu 26.04 LTSlinux-aws`pkg:deb/ubuntu/linux-aws?arch=source&distro=resolute`Other threats	Affected <7.0.0-1012.12	Fixed in 7.0.0-1012.12
Ubuntu 26.04 LTSlinux-azure`pkg:deb/ubuntu/linux-azure?arch=source&distro=resolute`Other threats	Affected 6.17.0-1003.3 – 7.0.0-1012.12 13 affected builds	Fixed in–
Ubuntu 26.04 LTSlinux-azure-fde`pkg:deb/ubuntu/linux-azure-fde?arch=source&distro=resolute`Other threats	Affected 7.0.0-1003.3 – 7.0.0-1011.11 7 affected builds	Fixed in–
Ubuntu 26.04 LTSlinux-gcp`pkg:deb/ubuntu/linux-gcp?arch=source&distro=resolute`Other threats	Affected <7.0.0-1011.11	Fixed in 7.0.0-1011.11
Ubuntu 26.04 LTSlinux-gke`pkg:deb/ubuntu/linux-gke?arch=source&distro=resolute`Other threats	Affected <7.0.0-1006.7	Fixed in 7.0.0-1006.7

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A patch is available and included in Linux kernel versions 7.0.0-31.31 and later for the linux-hwe-edge package and related kernel packages. Users should update their systems to the fixed kernel versions listed in the Ubuntu security advisories USN-8726-1 and USN-8727-1. After updating, a system reboot is required. Due to an ABI change, all third-party kernel modules must be recompiled and reinstalled. Following these steps will mitigate the vulnerability.

Description

In the Linux kernel, the following vulnerability has been resolved: libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo() Since commit 1e7ab6f67824 ("anon_inode: rework assertions"), path_noexec() warns when an anonymous-inode file is mmap'd from a superblock that has not set SB_I_NOEXEC. dma-buf backs its files this way and never set the flag, so mmap of any exported buffer trips the warning on a CONFIG_DEBUG_VFS=y kernel: WARNING: CPU: 11 PID: 121813 at fs/exec.c:118 path_noexec+0x47/0x50 do_mmap+0x2b5/0x680 vm_mmap_pgoff+0x129/0x210 ksys_mmap_pgoff+0x177/0x240 __x64_sys_mmap+0x33/0x70 init_pseudo() sets up internal SB_NOUSER mounts that are never path-reachable. Set both flags here so every pseudo filesystem gets them by default instead of each caller setting them. SB_I_NODEV is inert for unreachable mounts. SB_I_NOEXEC has one visible effect: an executable mapping of a pseudo-fs fd, such as a dma-buf, now fails with -EPERM, which is the invariant the assertion enforces. No in-tree caller maps these executable. Reproduce on CONFIG_DEBUG_VFS=y: make -C tools/testing/selftests/dmabuf-heaps sudo ./tools/testing/selftests/dmabuf-heaps/dmabuf-heap -t system

Impact

If unpatched, the vulnerability could allow executable mappings of pseudo-filesystem file descriptors, potentially violating expected security invariants. However, no known exploits are reported in the wild. The issue is part of multiple kernel security flaws that could be used by a local attacker to compromise system integrity or escalate privileges. The update mitigates these risks by enforcing stricter mount flags and other fixes across kernel subsystems.

Summary

The vulnerability (CVE-2026-64596) in the Linux kernel's libfs subsystem involved the absence of SB_I_NOEXEC and SB_I_NODEV flags in pseudo-filesystem mounts created by init_pseudo(), leading to warnings when anonymous-inode files backed by dma-buf were mmap'd without the SB_I_NOEXEC flag set. This could allow executable mappings of pseudo-filesystem file descriptors, which is now prevented by setting these flags by default. The fix was implemented starting with Linux kernel 7.0.0 and later versions. This vulnerability is part of a larger set of kernel security issues addressed in Ubuntu Linux kernel updates for various architectures and subsystems. The vendor advisory confirms patch availability and recommends updating to specific kernel package versions.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Sep 2026, 17:28 UTC

Technical details

References

Community reviews

Related threats