Riskcovery

CVE-2026-64253

kernel/fork: clear PF_BLOCK_TS in copy_process()

State
Published
Severity
Not scored
Published
Jul 24, 2026
Updated
Aug 17, 2026
Reserved
Jul 19, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

kernel/fork: clear PF_BLOCK_TS in copy_process()

PF_BLOCK_TS is only set in blk_time_get_ns() when current->plug is non-NULL, and blk_finish_plug() clears it via __blk_flush_plug() before NULLing the plug pointer. copy_process() breaks the invariant by inheriting PF_BLOCK_TS from the parent while resetting the child's plug to NULL.

Clear PF_BLOCK_TS alongside that assignment so callers can rely on "PF_BLOCK_TS set implies current->plug != NULL" and dereference current->plug unguarded.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 06b23f92af87a84d70881b2ecaa72e00f7838264 to before ee0801aceabdf583392477baf69a290b09448b8fAffected
  • 06b23f92af87a84d70881b2ecaa72e00f7838264 to before 99e6c712cc300883b8cbf03347d5359ec1a4d6ddAffected
  • 06b23f92af87a84d70881b2ecaa72e00f7838264 to before 77bba61a20f1b3d206f4f90e10a7bb3cd90b9619Affected
  • 06b23f92af87a84d70881b2ecaa72e00f7838264 to before fd38b75c4b43295b10d69772a46d1c74dbd6fc81Affected
LinuxLinux
  • 6.9Affected
  • before 6.9Not affected
  • 6.12.95 through 6.12.*Not affected
  • 6.18.38 through 6.18.*Not affected
  • 7.1.3 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.