Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-64253— kernel/fork: clear PF_BLOCK_TS in copy_process()

AI Predicted 5.5 Difficulty: Moderate EPSS 0.11% · P2

Possible ATT&CK Techniques 1AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 10

VendorProductVersion RangeStatus
LinuxLinux06b23f92af87a84d70881b2ecaa72e00f7838264< ee0801aceabdf583392477baf69a290b09448b8faffected
06b23f92af87a84d70881b2ecaa72e00f7838264< 99e6c712cc300883b8cbf03347d5359ec1a4d6ddaffected
06b23f92af87a84d70881b2ecaa72e00f7838264< 77bba61a20f1b3d206f4f90e10a7bb3cd90b9619affected
06b23f92af87a84d70881b2ecaa72e00f7838264< fd38b75c4b43295b10d69772a46d1c74dbd6fc81affected
6.9affected
< 6.9unaffected
6.12.95≤ 6.12.*unaffected
6.18.38≤ 6.18.*unaffected
… +2 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-64253

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
kernel/fork: clear PF_BLOCK_TS in copy_process()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: kernel/fork: clear PF_BLOCK_TS in copy_process() PF_BLOCK_TS is only set in blk_time_get_ns() when current->plug is non-NULL, and blk_finish_plug() clears it via __blk_flush_plug() before NULLing the plug pointer. copy_process() breaks the invariant by inheriting PF_BLOCK_TS from the parent while resetting the child's plug to NULL. Clear PF_BLOCK_TS alongside that assignment so callers can rely on "PF_BLOCK_TS set implies current->plug != NULL" and dereference current->plug unguarded.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 6.9版本存在安全漏洞，该漏洞源于copy_process()函数中继承PF_BLOCK_TS而子进程的plug指针被重置为NULL，违反了不变量，可能导致空指针取消引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 06b23f92af87a84d70881b2ecaa72e00f7838264 ~ ee0801aceabdf583392477baf69a290b09448b8f -
LinuxLinux 6.9 -

II. Public POCs for CVE-2026-64253

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64253

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-64253 (4)

Same Patch Batch · Linux · 2026-07-24 · 48 CVEs total

CVE-2026-642169.8 CRITICALnetfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
CVE-2026-642329.8 CRITICALblock: recompute nr_integrity_segments in blk_insert_cloned_request
CVE-2026-642558.8 HIGHwifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers
CVE-2026-642478.4 HIGHKVM: x86: hyper-v: Bound the bank index when querying sparse banks
CVE-2026-642238.1 HIGHwifi: mac80211: consume only present negotiated TTLM maps
CVE-2026-642358.1 HIGHx86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines
CVE-2026-642267.8 HIGHsched_ext: Avoid UAF in scx_root_enable_workfn() init failure path
CVE-2026-642177.8 HIGHnetfs: Fix overrun check in netfs_extract_user_iter()
CVE-2026-642187.8 HIGHbatman-adv: bla: fix report_work leak on backbone_gw purge
CVE-2026-642217.8 HIGHspi: ti-qspi: fix use-after-free after DMA setup failure
CVE-2026-642517.8 HIGHpwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next()
CVE-2026-642087.5 HIGHcrypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks
CVE-2026-642107.5 HIGHnet/mlx5e: xsk: Fix unlocked writing to ICOSQ
CVE-2026-642437.1 HIGHASoC: codecs: simple-mux: Fix enum control bounds check
CVE-2026-642197.0 HIGHdrm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_as
CVE-2026-642227.0 HIGHocteontx2-pf: avoid double free of pool->stack on AQ init failure
CVE-2026-64224octeontx2-pf: fix double free in rvu_rep_rsrc_init()
CVE-2026-64227ACPI: driver: Check ACPI_COMPANION() against NULL during probe
CVE-2026-64209phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config
CVE-2026-64225octeontx2-af: CGX: add bounds check to cgx_speed_mbps index

Showing top 20 of 48 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-64253

No comments yet

Leave a comment