CVE-2026-46259

procfs: fix missing RCU protection when reading real_parent in do_task_stat()

State: Published
Severity: 7.8 High
Published: Jun 3, 2026
Updated: Oct 19, 2026
Reserved: May 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

procfs: fix missing RCU protection when reading real_parent in do_task_stat()

When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which leads to:

cpu 0 cpu 1 ----- ----- do_task_stat var = task->real_parent release_task call_rcu(delayed_put_task_struct) task_tgid_nr_ns(var) rcu_read_lock <--- Too late to protect task->real_parent! task_pid_ptr <--- UAF! rcu_read_unlock

This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add proper RCU protection for accessing task->real_parent.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	06fffb1267c9d986687b69d74a46ee332a50575e to before fefa0fcd78be465b7ad4c497fa6ec90d64194c04Affected 06fffb1267c9d986687b69d74a46ee332a50575e to before c93a33f28f915d446eea6fb3f0e1def0b3af1982Affected 06fffb1267c9d986687b69d74a46ee332a50575e to before 1c8dc5b5517546c68ffae40b948336122bb61306Affected 06fffb1267c9d986687b69d74a46ee332a50575e to before 0e64bd46a04a4fd61279aca9f53a664e9e5f7e7eAffected 06fffb1267c9d986687b69d74a46ee332a50575e to before 73ec7c96601d61d52310c659145bb06d933a0fa6Affected 06fffb1267c9d986687b69d74a46ee332a50575e to before 4f9ae386861e280b7631ca252f798d25575627eeAffected 06fffb1267c9d986687b69d74a46ee332a50575e to before dd8b13cb4ff1a4545a214ed897fdf2bc341155b6Affected 06fffb1267c9d986687b69d74a46ee332a50575e to before 76149d53502cf17ef3ae454ff384551236fba867Affected
LinuxLinux	2.6.26Affected before 2.6.26Not affected 5.10.252 through 5.10.Not affected 5.15.202 through 5.15.Not affected 6.1.165 through 6.1.Not affected 6.6.128 through 6.6.Not affected 6.12.75 through 6.12.Not affected 6.18.14 through 6.18.Not affected 6.19.4 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

06fffb1267c9d986687b69d74a46ee332a50575e to before fefa0fcd78be465b7ad4c497fa6ec90d64194c04Affected
06fffb1267c9d986687b69d74a46ee332a50575e to before c93a33f28f915d446eea6fb3f0e1def0b3af1982Affected
06fffb1267c9d986687b69d74a46ee332a50575e to before 1c8dc5b5517546c68ffae40b948336122bb61306Affected
06fffb1267c9d986687b69d74a46ee332a50575e to before 0e64bd46a04a4fd61279aca9f53a664e9e5f7e7eAffected
06fffb1267c9d986687b69d74a46ee332a50575e to before 73ec7c96601d61d52310c659145bb06d933a0fa6Affected
06fffb1267c9d986687b69d74a46ee332a50575e to before 4f9ae386861e280b7631ca252f798d25575627eeAffected
06fffb1267c9d986687b69d74a46ee332a50575e to before dd8b13cb4ff1a4545a214ed897fdf2bc341155b6Affected
06fffb1267c9d986687b69d74a46ee332a50575e to before 76149d53502cf17ef3ae454ff384551236fba867Affected

LinuxLinux

2.6.26Affected
before 2.6.26Not affected
5.10.252 through 5.10.*Not affected
5.15.202 through 5.15.*Not affected
6.1.165 through 6.1.*Not affected
6.6.128 through 6.6.*Not affected
6.12.75 through 6.12.*Not affected
6.18.14 through 6.18.*Not affected
6.19.4 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.