The Linux kernel vulnerability CVE-2026-63865 involves the BPF subsystem's use of two functions, bpf_lsm_task_to_inode() and bpf_lsm_inet_conn_established(), in Linux Security Module (LSM) hooks that are sleepable. Since bpf_lsm_task_to_inode() is called under rcu_read_lock() and bpf_lsm_inet_conn_established() is called from softirq context, neither function is suitable for sleepable LSM programs. The vulnerability was resolved by removing these functions from sleepable LSM hooks to prevent improper usage.

The vulnerability could lead to incorrect behavior or instability in the kernel when sleepable LSM programs invoke these hooks, potentially causing system reliability issues. No known exploits in the wild have been reported. The exact impact on security or system compromise is not detailed in the available information.

A fix has been implemented in the Linux kernel by dropping the problematic functions from sleepable LSM hooks. No additional mitigation steps are indicated. Users should apply the official Linux kernel updates that include this fix once available. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisories for current remediation guidance.