---
id: CVE-2026-64375
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  proc: protect ptrace_may_access() with exec_update_lock (FD links)

  proc_pid_get_link() and proc_pid_readlink() currently look up the task from
  the pid once, then do th…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  proc: protect ptrace_may_access() with exec_update_lock (FD links)

  proc_pid_get_link() and proc_pid_readlink() currently look up the task from
  the pid once, then do th…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 2.6.18, < 5.10.261'
  - 'linux_kernel >= 5.11, < 5.15.212'
  - 'linux_kernel >= 5.16, < 6.1.178'
  - 'linux_kernel >= 6.2, < 6.6.145'
  - 'linux_kernel >= 6.7, < 6.12.97'
  - 'linux_kernel >= 6.13, < 6.18.40'
  - 'linux_kernel >= 6.19, < 7.1.4'
patched:
  - linux_kernel 7.1.4
published: '2026-07-25'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T14:31:06.567'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64375'
references:
  - url: 'https://git.kernel.org/stable/c/138c692d2b2d63d26f2eb957d0e4fcc5d61f9ff2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/497c6bae5167428596575f20af6613ff5671f383'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6253dfee5afba536bb54fc6fe6c091c3758fafe1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6255da28d4bb5349fe18e84cb043ccd394eba75d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/65bf0d2b6e914f1448d6a2fde193dcf60936a651'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/83b17872e3166c295c599279fc9562ac3840c638'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/de497d7aa2fae453a7e7c8f7d3e8682e565e3aaf'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dfd1894cb64cbd8758b461ed713800fe73db4f82'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-019113.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00131
epssPercentile: 0.03107
ingestedAt: '2026-07-27T06:16:50.886Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

proc: protect ptrace_may_access() with exec_update_lock (FD links)

proc_pid_get_link() and proc_pid_readlink() currently look up the task from
the pid once, then do the ptrace access check on that task, then look up
the task from the pid a second time to do the actual access.
That's racy in several ways.

To fix it, pass the task to the ->proc_get_link() handler, and instead of
proc_fd_access_allowed(), introduce a new helper call_proc_get_link() that
looks up and locks the task, does the access check, and calls
->proc_get_link().

## Affected

- `linux_kernel >= 2.6.18, < 5.10.261`
- `linux_kernel >= 5.11, < 5.15.212`
- `linux_kernel >= 5.16, < 6.1.178`
- `linux_kernel >= 6.2, < 6.6.145`
- `linux_kernel >= 6.7, < 6.12.97`
- `linux_kernel >= 6.13, < 6.18.40`
- `linux_kernel >= 6.19, < 7.1.4`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.1.4`