{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63865", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.017Z", "datePublished": "2026-07-19T14:04:51.215Z", "dateUpdated": "2026-08-05T12:36:41.333Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:36:41.333Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks\n\nbpf_lsm_task_to_inode() is called under rcu_read_lock() and\nbpf_lsm_inet_conn_established() is called from softirq context, so\nneither hook can be used by sleepable LSM programs."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires loading and attaching a sleepable BPF LSM program via bpf() syscalls; per kernel CNA guidance BPF subsystem issues are Local even though inet_conn_established fires during TCP receive processing.\nAC:L - Once a sleepable BPF LSM program is attached, the attacker reliably triggers the bug by making outbound TCP connections (inet_conn_established in softirq) or accessing /proc entries (task_to_inode under rcu_read_lock) without race-dependent conditions.\nPR:L - Loading BPF_PROG_TYPE_LSM programs requires CAP_BPF and CAP_PERFMON, both obtainable by an unprivileged user inside a user namespace (unshare -Ur) on typical Linux deployments with CONFIG_BPF_LSM enabled.\nUI:N - No victim user interaction is required; triggering occurs automatically from normal outbound TCP handshakes or /proc filesystem access after the sleepable BPF program is loaded.\nS:C - A container tenant with namespace CAP_BPF can load a sleepable BPF LSM on inet_conn_established or task_to_inode, and hook execution in host kernel softirq/RCU context can crash or corrupt the entire host, crossing the container-to-host security boundary.\nC:H - Executing sleepable BPF helpers (e.g. bpf_copy_from_user, GFP_KERNEL allocations) inside rcu_read_lock or softirq can corrupt kernel memory before detection, and such context violations are classifiable as exploitable memory-safety failures.\nI:H - Sleeping while holding TCP stack or RCU-protected locks can corrupt kernel data structures and potentially be leveraged for arbitrary kernel write or control-flow hijack, not merely a clean crash.\nA:H - Invoking might_sleep operations from softirq or RCU-critical sections reliably causes kernel BUG/oops/panic (\"sleeping function called from invalid context\"), producing complete host denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/bpf_lsm.c"], "versions": [{"version": "423f16108c9d832bd96059d5c882c8ef6d76eb96", "lessThan": "452a927cddcd67478d030e646f41cb904a93156f", "status": "affected", "versionType": "git"}, {"version": "423f16108c9d832bd96059d5c882c8ef6d76eb96", "lessThan": "f0fc2a9828171205244a28013f02889f50b71c9f", "status": "affected", "versionType": "git"}, {"version": "423f16108c9d832bd96059d5c882c8ef6d76eb96", "lessThan": "26b380a3ca0b605fd8860995ed6a208f276dd316", "status": "affected", "versionType": "git"}, {"version": "423f16108c9d832bd96059d5c882c8ef6d76eb96", "lessThan": "0d918263c9bfc86078edb2e2f7302a0c6ce42b7c", "status": "affected", "versionType": "git"}, {"version": "423f16108c9d832bd96059d5c882c8ef6d76eb96", "lessThan": "281f2a214565a5cbf8b7355a65738d80bd19b8c5", "status": "affected", "versionType": "git"}, {"version": "423f16108c9d832bd96059d5c882c8ef6d76eb96", "lessThan": "989f1b93907de1753a814996222da375f07e579b", "status": "affected", "versionType": "git"}, {"version": "423f16108c9d832bd96059d5c882c8ef6d76eb96", "lessThan": "beaf0e96b1da74549a6cabd040f9667d83b2e97e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/bpf_lsm.c"], "versions": [{"version": "5.11", "status": "affected"}, {"version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.141", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.91", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.33", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.6.141"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.12.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.18.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/452a927cddcd67478d030e646f41cb904a93156f"}, {"url": "https://git.kernel.org/stable/c/f0fc2a9828171205244a28013f02889f50b71c9f"}, {"url": "https://git.kernel.org/stable/c/26b380a3ca0b605fd8860995ed6a208f276dd316"}, {"url": "https://git.kernel.org/stable/c/0d918263c9bfc86078edb2e2f7302a0c6ce42b7c"}, {"url": "https://git.kernel.org/stable/c/281f2a214565a5cbf8b7355a65738d80bd19b8c5"}, {"url": "https://git.kernel.org/stable/c/989f1b93907de1753a814996222da375f07e579b"}, {"url": "https://git.kernel.org/stable/c/beaf0e96b1da74549a6cabd040f9667d83b2e97e"}], "title": "bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/bpf_lsm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "452a927cddcd67478d030e646f41cb904a93156f", "status": "affected", "version": "423f16108c9d832bd96059d5c882c8ef6d76eb96", "versionType": "git"}, {"lessThan": "f0fc2a9828171205244a28013f02889f50b71c9f", "status": "affected", "version": "423f16108c9d832bd96059d5c882c8ef6d76eb96", "versionType": "git"}, {"lessThan": "26b380a3ca0b605fd8860995ed6a208f276dd316", "status": "affected", "version": "423f16108c9d832bd96059d5c882c8ef6d76eb96", "versionType": "git"}, {"lessThan": "0d918263c9bfc86078edb2e2f7302a0c6ce42b7c", "status": "affected", "version": "423f16108c9d832bd96059d5c882c8ef6d76eb96", "versionType": "git"}, {"lessThan": "281f2a214565a5cbf8b7355a65738d80bd19b8c5", "status": "affected", "version": "423f16108c9d832bd96059d5c882c8ef6d76eb96", "versionType": "git"}, {"lessThan": "989f1b93907de1753a814996222da375f07e579b", "status": "affected", "version": "423f16108c9d832bd96059d5c882c8ef6d76eb96", "versionType": "git"}, {"lessThan": "beaf0e96b1da74549a6cabd040f9667d83b2e97e", "status": "affected", "version": "423f16108c9d832bd96059d5c882c8ef6d76eb96", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/bpf/bpf_lsm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"lessThan": "5.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.141", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.91", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.33", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks\n\nbpf_lsm_task_to_inode() is called under rcu_read_lock() and\nbpf_lsm_inet_conn_established() is called from softirq context, so\nneither hook can be used by sleepable LSM programs."}], "id": "CVE-2026-63865", "lastModified": "2026-07-27T17:44:23.777", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-19T15:16:53.400", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0d918263c9bfc86078edb2e2f7302a0c6ce42b7c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/26b380a3ca0b605fd8860995ed6a208f276dd316"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/281f2a214565a5cbf8b7355a65738d80bd19b8c5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/452a927cddcd67478d030e646f41cb904a93156f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/989f1b93907de1753a814996222da375f07e579b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/beaf0e96b1da74549a6cabd040f9667d83b2e97e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f0fc2a9828171205244a28013f02889f50b71c9f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks", "id": "2502279", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502279"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-663", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks\nbpf_lsm_task_to_inode() is called under rcu_read_lock() and\nbpf_lsm_inet_conn_established() is called from softirq context, so\nneither hook can be used by sleepable LSM programs.", "A flaw was found in the Linux kernel. The Berkeley Packet Filter (BPF) Linux Security Modules (LSM) feature incorrectly registered certain hooks, `task_to_inode` and `inet_conn_established`, as available for sleepable programs. These hooks are invoked in critical system contexts where program sleeping is not allowed. An attacker could potentially exploit this by loading a malicious BPF LSM program, leading to system instability or a kernel crash."], "name": "CVE-2026-63865", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63865\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63865\nhttps://lore.kernel.org/linux-cve-announce/2026071934-CVE-2026-63865-5cb3@gregkh/T"], "threat_severity": "Moderate"}