5.5

CVE-2026-64253

kernel/fork: clear PF_BLOCK_TS in copy_process()

In the Linux kernel, the following vulnerability has been resolved:

kernel/fork: clear PF_BLOCK_TS in copy_process()

PF_BLOCK_TS is only set in blk_time_get_ns() when current->plug is
non-NULL, and blk_finish_plug() clears it via __blk_flush_plug()
before NULLing the plug pointer.  copy_process() breaks the
invariant by inheriting PF_BLOCK_TS from the parent while resetting
the child's plug to NULL.

Clear PF_BLOCK_TS alongside that assignment so callers can rely on
"PF_BLOCK_TS set implies current->plug != NULL" and dereference
current->plug unguarded.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 6.9 < 6.12.95
Linux ≫ Linux Kernel Version >= 6.13 < 6.18.38
Linux ≫ Linux Kernel Version >= 6.19 < 7.1.3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.11% 0.017
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

https://git.kernel.org/stable/c/ee0801aceabdf583392477baf69a290b09448b8f
Patch
https://git.kernel.org/stable/c/99e6c712cc300883b8cbf03347d5359ec1a4d6dd
Patch
https://git.kernel.org/stable/c/77bba61a20f1b3d206f4f90e10a7bb3cd90b9619
Patch
https://git.kernel.org/stable/c/fd38b75c4b43295b10d69772a46d1c74dbd6fc81
Patch