CVE-2026-63865: Linux Kernel Privilege Escalation Flaw

CVE-2026-63865 Overview

CVE-2026-63865 affects the Linux kernel's Berkeley Packet Filter (BPF) Linux Security Module (LSM) subsystem. The vulnerability stems from two LSM hooks, bpf_lsm_task_to_inode() and bpf_lsm_inet_conn_established(), being exposed to sleepable BPF LSM programs. The first hook runs under rcu_read_lock(), and the second runs from softirq context. Neither context permits sleeping, so attaching sleepable programs to these hooks can trigger scheduling violations inside atomic contexts. The upstream fix removes both hooks from the list of sleepable-capable LSM attach points.

Critical Impact
A local attacker with the ability to load BPF LSM programs can invoke sleeping operations inside atomic kernel contexts, leading to kernel instability and potential compromise of confidentiality, integrity, and availability.

Affected Products

Linux kernel builds that expose bpf_lsm_task_to_inode as a sleepable LSM hook
Linux kernel builds that expose bpf_lsm_inet_conn_established as a sleepable LSM hook
Distributions shipping kernels prior to the referenced stable commits

Discovery Timeline

2026-07-19 - CVE-2026-63865 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63865

Vulnerability Analysis

The Linux kernel BPF LSM framework lets privileged users attach BPF programs to LSM hook points. Sleepable BPF programs can call helpers that block or sleep, so the kernel must gate them to hooks running in a context where sleeping is safe.

The kernel incorrectly permitted sleepable attachment on two hooks whose call sites are atomic. bpf_lsm_task_to_inode() executes while an RCU read-side critical section is held, and bpf_lsm_inet_conn_established() executes from softirq context. Sleeping in either context violates kernel invariants and can corrupt scheduler and RCU state.

The attack surface is local, but the exposure is scoped: an attacker requires the ability to load BPF LSM programs, typically CAP_BPF or CAP_SYS_ADMIN. In containerized or multi-tenant systems where BPF capabilities are exposed to workloads, this widens the practical exposure.

Root Cause

The root cause is a missing exclusion in the sleepable LSM hook allow list. The BPF verifier and attach logic did not exclude hook sites whose callers hold rcu_read_lock() or run in softirq. Consult the referenced kernel commits for the exact hook table change.

Attack Vector

An authenticated local user with BPF LSM privileges attaches a sleepable BPF program to bpf_lsm_task_to_inode or bpf_lsm_inet_conn_established. When the kernel invokes the hook during normal task or TCP connection activity, the sleepable helper attempts to sleep in an atomic context, breaking scheduler assumptions. Full exploitation details are described in the upstream commits, including Kernel Git Commit 0d91826 and Kernel Git Commit 452a927.

No public proof-of-concept code is available. Describe the mechanism in prose only.

Detection Methods for CVE-2026-63865

Indicators of Compromise

Kernel log entries reporting BUG: sleeping function called from invalid context referencing BPF LSM hook symbols
RCU stall or soft lockup warnings correlated with BPF program attach or load events
Audit records showing bpf() syscalls attaching sleepable programs to task_to_inode or inet_conn_established attach points

Detection Strategies

Enumerate loaded BPF programs with bpftool prog show and inspect programs of type BPF_PROG_TYPE_LSM with the sleepable flag set
Alert on bpf() syscalls with BPF_PROG_LOAD where expected_attach_type targets the two vulnerable hook symbols
Correlate kernel panic or soft lockup telemetry with recent BPF LSM program load activity

Monitoring Recommendations

Ingest /var/log/kern.log, dmesg, and audit logs into a central platform to identify atomic-context sleep warnings
Track processes granted CAP_BPF or CAP_SYS_ADMIN and monitor their BPF load activity
Baseline expected BPF LSM programs and flag deviations, especially newly loaded sleepable programs

How to Mitigate CVE-2026-63865

Immediate Actions Required

Apply the kernel updates that drop task_to_inode and inet_conn_established from the sleepable LSM hook allow list
Inventory hosts running vulnerable kernels and prioritize systems where BPF capabilities are exposed to non-root workloads
Restrict CAP_BPF and CAP_SYS_ADMIN to trusted administrators only

Patch Information

Upstream fixes have been merged into stable kernel trees. Reference the following commits for the exact source changes: Kernel Git Commit 0d91826, Kernel Git Commit 26b380a, Kernel Git Commit 281f2a2, Kernel Git Commit 452a927, Kernel Git Commit 989f1b9, Kernel Git Commit beaf0e9, and Kernel Git Commit f0fc2a9. Rebuild or update distribution kernels to include these commits and reboot affected hosts.

Workarounds

Disable unprivileged BPF by setting kernel.unprivileged_bpf_disabled=1 in sysctl configuration
Remove CAP_BPF and CAP_SYS_ADMIN from containers and non-administrative users
Use seccomp or LSM policies to block the bpf() syscall for workloads that do not require it

bash

# Configuration example
# Disable unprivileged BPF loading system-wide
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-bpf-hardening.conf
sudo sysctl --system

# Enumerate loaded BPF LSM programs for audit
sudo bpftool prog show | grep -i lsm