CVE-2026-64253
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
36/100
Published: 2026-07-24
Modified: 2026-11-08
First seen: 2026-11-06
Status: active
Attack Surface
Low Complexity
No Interaction
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
None
I:
None
A:
High
Description
In the Linux kernel, the following vulnerability has been resolved: kernel/fork: clear PF_BLOCK_TS in copy_process() PF_BLOCK_TS is only set in blk_time_get_ns() when current->plug is non-NULL, and blk_finish_plug() clears it via __blk_flush_plug() before NULLing the plug pointer. copy_process() breaks the invariant by inheriting PF_BLOCK_TS from the parent while resetting the child's plug to NULL. Clear PF_BLOCK_TS alongside that assignment so callers can rely on "PF_BLOCK_TS set implies current->plug != NULL" and dereference current->plug unguarded.
Weakness Classification (1)
Affected Software (6)
| Vendor | Product | Version |
|---|---|---|
| Linux | Linux | 06b23f92af87a84d70881b2ecaa72e00f7838264 < ee0801aceabdf583392477baf69a290b09448b8f |
| Linux | Linux | 06b23f92af87a84d70881b2ecaa72e00f7838264 < 99e6c712cc300883b8cbf03347d5359ec1a4d6dd |
| Linux | Linux | 06b23f92af87a84d70881b2ecaa72e00f7838264 < 77bba61a20f1b3d206f4f90e10a7bb3cd90b9619 |
| Linux | Linux | 06b23f92af87a84d70881b2ecaa72e00f7838264 < fd38b75c4b43295b10d69772a46d1c74dbd6fc81 |
| Linux | Linux | 6.9 |
| linux | linux_kernel | 6.9 – 6.12.95 |