CVE-2026-63799 Overview
CVE-2026-63799 is an out-of-bounds write vulnerability in the Linux kernel scheduler's memory concurrency ID (mm_cid) subsystem. The flaw resides in mm_cid_fixup_cpus_to_tasks(), where the transition bit is set on a CID equal to the MM_CID_UNSET sentinel value. When this tainted value later reaches mm_cid_schedout(), it is passed to clear_bit() with bit number 31, triggering a deterministic out-of-bounds bit clear at a fixed offset of 256 MiB past the CID bitmap base embedded in the mm_struct slab object. Syzkaller surfaced the issue as a KASAN use-after-free report in __schedule via mm_cid_switch_to.
Critical Impact
A local attacker with the ability to trigger fork/exec races in per-CPU CID mode can cause bounded kernel memory corruption, potentially leading to kernel instability or privilege escalation depending on adjacent object layout.
Affected Products
- Linux kernel versions containing the mm_cid per-CPU mode fixup path
- Distributions shipping kernels prior to commits 8d32856fb72b and de3ab9bd3133
- Systems running per-CPU CID mode with active scheduler workloads
Discovery Timeline
- 2026-07-19 - CVE-2026-63799 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-63799
Vulnerability Analysis
The vulnerability affects the Linux kernel scheduler's mm_cid subsystem, which manages per-memory-descriptor concurrency identifiers used to reduce contention on shared data structures. In per-CPU CID mode, newly forked or exec()'d tasks run with mm_cid.cid == MM_CID_UNSET because CIDs are assigned lazily on schedule-in. This creates a window during which the fixup path can operate on an uninitialized CID value.
When mm_cid_fixup_cpus_to_tasks() walks a task in this state, the cid_in_transit() check passes for MM_CID_UNSET because the transit bit is not set. The function then converts the value to MM_CID_UNSET | MM_CID_TRANSIT and stores it back into the task's CID field. The corruption manifests later in mm_cid_schedout(), which strips the transit bit via cid_from_transit_cid() but leaves MM_CID_UNSET intact. This fails the cid < max_cids convergence check and falls into mm_drop_cid(), which calls clear_bit(MM_CID_UNSET, mm_cidmask(mm)).
Root Cause
The root cause is a missing guard in the transition-bit assignment logic. The existing cid_in_transit() check is insufficient because it does not exclude the MM_CID_UNSET sentinel value, which corresponds to BIT(31). The CID bitmap embedded in the mm_struct slab object is only num_possible_cpus() bits wide, so clearing bit 31 writes 256 MiB past the bitmap base.
Attack Vector
Exploitation requires local access and specific timing. The trigger conditions are per-CPU CID mode operation, an active task with MM_CID_UNSET in the fork/exec window before its next schedule-in, and a per-CPU to per-task fixup walk. The fixup is driven by thread exit through sched_mm_cid_exit() or by the deferred max_cids recompute in mm_cid_work_fn(). The corruption is bounded — not attacker-influenced in address or value — and clears one bit at a fixed offset in whatever kernel object occupies that location in the direct map.
The vulnerability manifests in the scheduler fixup path. See the kernel commit fix for the exact code changes.
Detection Methods for CVE-2026-63799
Indicators of Compromise
- KASAN reports referencing __schedule with call stacks passing through mm_cid_switch_to and mm_cid_schedout
- Kernel warnings or oops messages involving clear_bit operations against mm_cidmask
- Unexplained kernel object corruption at offsets 256 MiB from mm_struct bitmap allocations
Detection Strategies
- Enable KASAN (Kernel Address Sanitizer) on test and development kernels to catch the out-of-bounds bit clear
- Monitor dmesg and kernel audit logs for use-after-free or out-of-bounds warnings originating in scheduler code paths
- Correlate syzkaller-style fuzzing signatures with the mm_cid_switch_to call site
Monitoring Recommendations
- Track kernel crash dumps and panic events on hosts running affected kernel versions with heavy fork/exec workloads
- Deploy runtime kernel telemetry to record scheduler subsystem faults and unexpected reboots
- Aggregate host telemetry into a centralized data lake to identify clusters of scheduler-related instability across the fleet
How to Mitigate CVE-2026-63799
Immediate Actions Required
- Apply the upstream kernel patches identified by commits 8d32856fb72b and de3ab9bd3133 as soon as they are available from your distribution
- Inventory Linux hosts running kernel versions with per-CPU CID mode enabled and prioritize patching
- Restrict local shell and container escape surfaces on multi-tenant systems until patches are deployed
Patch Information
The fix guards the transition-bit assignment against MM_CID_UNSET in addition to the existing cid_in_transit() check, ensuring the transit bit is only set on a genuine task-owned CID. CPU-owned (MM_CID_ONCPU) CIDs of running active tasks are already handled by the cid_on_cpu(pcp->cid) branch and never reach this path. Refer to the upstream commit for the authoritative patch.
Workarounds
- No direct configuration workaround eliminates the race; patching is the definitive remediation
- Reduce fork/exec churn on sensitive hosts to shrink the vulnerable window until patches are applied
- Limit local user access and container privileges to reduce the pool of principals capable of triggering the code path
# Verify running kernel version and check for the fix
uname -r
# Query package manager for available kernel updates (example: Debian/Ubuntu)
apt list --upgradable | grep linux-image
# After patching, reboot into the fixed kernel
sudo reboot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
