In the Linux kernel, the following vulnerability has been resolved: proc: protect ptrace_may_access() with exec_update_lock (part 1) Fix the easy… (CVE-2026-64371)
Source GCVE Database
Not known to be exploited : monitor for a fix to affected systems.
Data as of 10/24/2026, 20:40:31 UTC
No CVSS score from NVD or the CNA
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 2% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
A fix is available that adds exec_update_lock protection to ptrace_may_access() calls in procfs or uses mm_access() where appropriate. Users should update their Linux kernel to a version including this patch once available. Patch status is not explicitly confirmed in the input; check the vendor advisory for current remediation guidance.
Description
A medium severity vulnerability in the Linux kernel related to the proc filesystem was resolved by adding proper locking to ptrace_may_access() calls. The fix involves protecting these calls with exec_update_lock or using mm_access() to prevent race conditions during process status and memory map queries.
Impact
The vulnerability could allow race conditions when accessing process information via procfs, potentially leading to inconsistent or incorrect data being read. The exact impact is not detailed, but the medium severity suggests a moderate risk of information disclosure or process state inconsistencies.
Summary
The Linux kernel vulnerability CVE-2026-64371 involves insufficient locking around ptrace_may_access() calls within procfs. Specifically, several procfs functions such as do_task_stat(), proc_pid_wchan(), proc_map_files_lookup(), proc_map_files_readdir(), proc_ns_get_link(), and proc_ns_readlink() called ptrace_may_access() without holding the exec_update_lock, leading to potential race conditions. The patch adds exec_update_lock protection or replaces get_task_mm() with mm_access() to ensure safe access to task memory and execution state.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64371 (opens in a new tab)
- git.kernel.org/stable/c/4bfe8c481846cee52473a2f7d7b30ee8e6749fc4 (opens in a new tab)
- git.kernel.org/stable/c/6650527444dadc63d84aa939d14ecba4fadb2f69 (opens in a new tab)
- git.kernel.org/stable/c/7456ae990a9738962b33146916fabca62ae3d4e0 (opens in a new tab)
- git.kernel.org/stable/c/ae1e630bcaac739f625822078edbaea98366930d (opens in a new tab)
- git.kernel.org/stable/c/bb43679356f1f2a4c6b1c88aec4f021e5b5c74e9 (opens in a new tab)
- git.kernel.org/stable/c/c1cfd63326f5d09999134e9052c353faf738286e (opens in a new tab)
- git.kernel.org/stable/c/d54f14655fd7d7b293698a8b6918563c4c0465e7 (opens in a new tab)
- git.kernel.org/stable/c/f9b4b03ccc9c69bf7f7298d4559906ebea7143b3 (opens in a new tab)
- cert-portal.siemens.com/productcert/html/ssa-019113.html (opens in a new tab)