{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63865", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.017Z", "datePublished": "2026-07-19T14:04:51.215Z", "dateUpdated": "2026-07-20T13:40:59.327Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-20T13:40:59.327Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks\n\nbpf_lsm_task_to_inode() is called under rcu_read_lock() and\nbpf_lsm_inet_conn_established() is called from softirq context, so\nneither hook can be used by sleepable LSM programs."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/bpf_lsm.c"], "versions": [{"version": "423f16108c9d832bd96059d5c882c8ef6d76eb96", "lessThan": "452a927cddcd67478d030e646f41cb904a93156f", "status": "affected", "versionType": "git"}, {"version": "423f16108c9d832bd96059d5c882c8ef6d76eb96", "lessThan": "f0fc2a9828171205244a28013f02889f50b71c9f", "status": "affected", "versionType": "git"}, {"version": "423f16108c9d832bd96059d5c882c8ef6d76eb96", "lessThan": "26b380a3ca0b605fd8860995ed6a208f276dd316", "status": "affected", "versionType": "git"}, {"version": "423f16108c9d832bd96059d5c882c8ef6d76eb96", "lessThan": "0d918263c9bfc86078edb2e2f7302a0c6ce42b7c", "status": "affected", "versionType": "git"}, {"version": "423f16108c9d832bd96059d5c882c8ef6d76eb96", "lessThan": "281f2a214565a5cbf8b7355a65738d80bd19b8c5", "status": "affected", "versionType": "git"}, {"version": "423f16108c9d832bd96059d5c882c8ef6d76eb96", "lessThan": "989f1b93907de1753a814996222da375f07e579b", "status": "affected", "versionType": "git"}, {"version": "423f16108c9d832bd96059d5c882c8ef6d76eb96", "lessThan": "beaf0e96b1da74549a6cabd040f9667d83b2e97e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/bpf_lsm.c"], "versions": [{"version": "5.11", "status": "affected"}, {"version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.141", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.91", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.33", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.6.141"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.12.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.18.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/452a927cddcd67478d030e646f41cb904a93156f"}, {"url": "https://git.kernel.org/stable/c/f0fc2a9828171205244a28013f02889f50b71c9f"}, {"url": "https://git.kernel.org/stable/c/26b380a3ca0b605fd8860995ed6a208f276dd316"}, {"url": "https://git.kernel.org/stable/c/0d918263c9bfc86078edb2e2f7302a0c6ce42b7c"}, {"url": "https://git.kernel.org/stable/c/281f2a214565a5cbf8b7355a65738d80bd19b8c5"}, {"url": "https://git.kernel.org/stable/c/989f1b93907de1753a814996222da375f07e579b"}, {"url": "https://git.kernel.org/stable/c/beaf0e96b1da74549a6cabd040f9667d83b2e97e"}], "title": "bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{}

{"bugzilla": {"description": "kernel: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks", "id": "2502279", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502279"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-663", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks\nbpf_lsm_task_to_inode() is called under rcu_read_lock() and\nbpf_lsm_inet_conn_established() is called from softirq context, so\nneither hook can be used by sleepable LSM programs.", "A flaw was found in the Linux kernel. The Berkeley Packet Filter (BPF) Linux Security Modules (LSM) feature incorrectly registered certain hooks, `task_to_inode` and `inet_conn_established`, as available for sleepable programs. These hooks are invoked in critical system contexts where program sleeping is not allowed. An attacker could potentially exploit this by loading a malicious BPF LSM program, leading to system instability or a kernel crash."], "name": "CVE-2026-63865", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63865\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63865\nhttps://lore.kernel.org/linux-cve-announce/2026071934-CVE-2026-63865-5cb3@gregkh/T"], "threat_severity": "Moderate"}