{"id":"CVE-2026-63865","state":"PUBLISHED","title":"bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks\n\nbpf_lsm_task_to_inode() is called under rcu_read_lock() and\nbpf_lsm_inet_conn_established() is called from softirq context, so\nneither hook can be used by sleepable LSM programs.","publishedAt":"2026-07-19T14:04:51.215Z","updatedAt":"2026-08-05T12:36:41.333Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"423f16108c9d832bd96059d5c882c8ef6d76eb96","status":"affected","lessThan":"452a927cddcd67478d030e646f41cb904a93156f","versionType":"git"},{"version":"423f16108c9d832bd96059d5c882c8ef6d76eb96","status":"affected","lessThan":"f0fc2a9828171205244a28013f02889f50b71c9f","versionType":"git"},{"version":"423f16108c9d832bd96059d5c882c8ef6d76eb96","status":"affected","lessThan":"26b380a3ca0b605fd8860995ed6a208f276dd316","versionType":"git"},{"version":"423f16108c9d832bd96059d5c882c8ef6d76eb96","status":"affected","lessThan":"0d918263c9bfc86078edb2e2f7302a0c6ce42b7c","versionType":"git"},{"version":"423f16108c9d832bd96059d5c882c8ef6d76eb96","status":"affected","lessThan":"281f2a214565a5cbf8b7355a65738d80bd19b8c5","versionType":"git"},{"version":"423f16108c9d832bd96059d5c882c8ef6d76eb96","status":"affected","lessThan":"989f1b93907de1753a814996222da375f07e579b","versionType":"git"},{"version":"423f16108c9d832bd96059d5c882c8ef6d76eb96","status":"affected","lessThan":"beaf0e96b1da74549a6cabd040f9667d83b2e97e","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/bpf/bpf_lsm.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.11","versionType":"semver"},{"version":"5.15.209","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.141","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.91","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.33","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.10","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/bpf/bpf_lsm.c"]}],"references":["https://git.kernel.org/stable/c/452a927cddcd67478d030e646f41cb904a93156f","https://git.kernel.org/stable/c/f0fc2a9828171205244a28013f02889f50b71c9f","https://git.kernel.org/stable/c/26b380a3ca0b605fd8860995ed6a208f276dd316","https://git.kernel.org/stable/c/0d918263c9bfc86078edb2e2f7302a0c6ce42b7c","https://git.kernel.org/stable/c/281f2a214565a5cbf8b7355a65738d80bd19b8c5","https://git.kernel.org/stable/c/989f1b93907de1753a814996222da375f07e579b","https://git.kernel.org/stable/c/beaf0e96b1da74549a6cabd040f9667d83b2e97e"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/63xxx/CVE-2026-63865.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-63865","state":"PUBLISHED","datePublished":"2026-07-19T14:04:51.215Z","dateUpdated":"2026-08-05T12:36:41.333Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-19T07:54:57.017Z"},"containers":{"cna":{"title":"bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks\n\nbpf_lsm_task_to_inode() is called under rcu_read_lock() and\nbpf_lsm_inet_conn_established() is called from softirq context, so\nneither hook can be used by sleepable LSM programs."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"423f16108c9d832bd96059d5c882c8ef6d76eb96","status":"affected","lessThan":"452a927cddcd67478d030e646f41cb904a93156f","versionType":"git"},{"version":"423f16108c9d832bd96059d5c882c8ef6d76eb96","status":"affected","lessThan":"f0fc2a9828171205244a28013f02889f50b71c9f","versionType":"git"},{"version":"423f16108c9d832bd96059d5c882c8ef6d76eb96","status":"affected","lessThan":"26b380a3ca0b605fd8860995ed6a208f276dd316","versionType":"git"},{"version":"423f16108c9d832bd96059d5c882c8ef6d76eb96","status":"affected","lessThan":"0d918263c9bfc86078edb2e2f7302a0c6ce42b7c","versionType":"git"},{"version":"423f16108c9d832bd96059d5c882c8ef6d76eb96","status":"affected","lessThan":"281f2a214565a5cbf8b7355a65738d80bd19b8c5","versionType":"git"},{"version":"423f16108c9d832bd96059d5c882c8ef6d76eb96","status":"affected","lessThan":"989f1b93907de1753a814996222da375f07e579b","versionType":"git"},{"version":"423f16108c9d832bd96059d5c882c8ef6d76eb96","status":"affected","lessThan":"beaf0e96b1da74549a6cabd040f9667d83b2e97e","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/bpf/bpf_lsm.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.11","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.11","versionType":"semver"},{"version":"5.15.209","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.175","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.141","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.91","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.33","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.10","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/bpf/bpf_lsm.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/452a927cddcd67478d030e646f41cb904a93156f"},{"url":"https://git.kernel.org/stable/c/f0fc2a9828171205244a28013f02889f50b71c9f"},{"url":"https://git.kernel.org/stable/c/26b380a3ca0b605fd8860995ed6a208f276dd316"},{"url":"https://git.kernel.org/stable/c/0d918263c9bfc86078edb2e2f7302a0c6ce42b7c"},{"url":"https://git.kernel.org/stable/c/281f2a214565a5cbf8b7355a65738d80bd19b8c5"},{"url":"https://git.kernel.org/stable/c/989f1b93907de1753a814996222da375f07e579b"},{"url":"https://git.kernel.org/stable/c/beaf0e96b1da74549a6cabd040f9667d83b2e97e"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires loading and attaching a sleepable BPF LSM program via bpf() syscalls; per kernel CNA guidance BPF subsystem issues are Local even though inet_conn_established fires during TCP receive processing.\nAC:L - Once a sleepable BPF LSM program is attached, the attacker reliably triggers the bug by making outbound TCP connections (inet_conn_established in softirq) or accessing /proc entries (task_to_inode under rcu_read_lock) without race-dependent conditions.\nPR:L - Loading BPF_PROG_TYPE_LSM programs requires CAP_BPF and CAP_PERFMON, both obtainable by an unprivileged user inside a user namespace (unshare -Ur) on typical Linux deployments with CONFIG_BPF_LSM enabled.\nUI:N - No victim user interaction is required; triggering occurs automatically from normal outbound TCP handshakes or /proc filesystem access after the sleepable BPF program is loaded.\nS:C - A container tenant with namespace CAP_BPF can load a sleepable BPF LSM on inet_conn_established or task_to_inode, and hook execution in host kernel softirq/RCU context can crash or corrupt the entire host, crossing the container-to-host security boundary.\nC:H - Executing sleepable BPF helpers (e.g. bpf_copy_from_user, GFP_KERNEL allocations) inside rcu_read_lock or softirq can corrupt kernel memory before detection, and such context violations are classifiable as exploitable memory-safety failures.\nI:H - Sleeping while holding TCP stack or RCU-protected locks can corrupt kernel data structures and potentially be leveraged for arbitrary kernel write or control-flow hijack, not merely a clean crash.\nA:H - Invoking might_sleep operations from softirq or RCU-critical sections reliably causes kernel BUG/oops/panic (\"sleeping function called from invalid context\"), producing complete host denial of service."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:36:41.333Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.209"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.1.175"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.6.141"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.12.91"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"6.18.33"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"7.0.10"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"7.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}