The Linux kernel vulnerability CVE-2026-63799 involves an out-of-bounds clear_bit() operation triggered when the mm_cid.cid is MM_CID_UNSET in the fixup path of mm_cid_fixup_cpus_to_tasks(). The bug arises because the transition bit is set on MM_CID_UNSET, which is a fixed sentinel value (BIT(31)), leading to a clear_bit() call with bit number 31 on a bitmap that is only as large as the number of possible CPUs. This causes a deterministic OOB write 256 MiB beyond the bitmap base, corrupting a single bit of kernel memory at a fixed offset. The vulnerability only triggers in per-CPU CID mode during a brief window after fork or execve before the task's CID is assigned on schedule-in. The fix adds an explicit guard to prevent setting the transition bit on MM_CID_UNSET, ensuring the bit clear operation does not occur out-of-bounds.

This vulnerability results in a bounded out-of-bounds write that corrupts a single bit of kernel memory at a fixed offset 256 MiB beyond the intended bitmap. The corrupted memory location is not attacker-controlled, so the corruption is unpredictable and limited in scope. It does not allow arbitrary memory write or arbitrary value write. The issue can cause kernel memory corruption and was observed as a use-after-free by KASAN in kernel scheduling code. It only occurs in per-CPU CID mode during a narrow timing window after fork or execve before CID assignment.

A fix for this vulnerability has been implemented in the Linux kernel by adding a guard to prevent setting the transition bit when the CID is MM_CID_UNSET. Users should update to the fixed kernel version once available. Since this is a kernel vulnerability, applying the official kernel patch or upgrading to a kernel version that includes this fix is the recommended remediation. No other mitigations are indicated by the vendor advisory.