CVE-2026-64111: Linux Kernel Privilege Escalation Flaw

CVE-2026-64111 Overview

CVE-2026-64111 is a Linux kernel vulnerability in the Linux Security Module (LSM) subsystem. The flaw exists in the lsm_set_self_attr() code path, which failed to hold the cred_guard_mutex before invoking the LSM hook. The proc_pid_attr_write() path already acquires this mutex, but lsm_set_self_attr() did not, creating an inconsistency in credential handling.

The missing lock affects SELinux and AppArmor, which use it to check whether the calling process is being ptraced and to decide whether to allow a security context transition. Local users can leverage this race condition to influence LSM state changes during process credential updates.

Critical Impact
Local attackers with low privileges can trigger unsafe LSM attribute transitions, potentially bypassing SELinux and AppArmor ptrace-based transition checks and impacting confidentiality and integrity of security decisions.

Affected Products

Linux kernel versions containing the lsm_set_self_attr() implementation prior to the fix commits
Systems using SELinux as the active Linux Security Module
Systems using AppArmor as the active Linux Security Module

Discovery Timeline

2026-07-19 - CVE-2026-64111 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64111

Vulnerability Analysis

The vulnerability is a race condition [Race Condition, TOCTOU class] in the Linux kernel LSM framework. The lsm_set_self_attr() system call allows a process to set its own LSM attributes, such as the SELinux security context or AppArmor profile. When the LSM hook is invoked, SELinux and AppArmor consult ptrace state to determine whether the requested credential transition is permitted.

The cred_guard_mutex is the kernel serialization primitive that guarantees credential state remains stable across the check. Without it, another thread can attach or detach ptrace, or modify credentials, between the time the LSM check reads state and the moment the transition is committed. The proc_pid_attr_write() write path, which reaches the same LSM hooks through /proc/self/attr, already holds this mutex, making the inconsistency a clear correctness gap.

Root Cause

The root cause is a missing lock acquisition. lsm_set_self_attr() calls into security_setselfattr() and downstream SELinux and AppArmor callbacks without first acquiring cred_guard_mutex on the current task. The mutex is required whenever LSM decisions depend on ptrace state or on the stability of task_struct credential fields during a transition.

Attack Vector

A local unprivileged process invokes lsm_set_self_attr() while a second, cooperating process races ptrace attach or detach operations against the target. Because the LSM hook reads ptrace state without holding cred_guard_mutex, the attacker can arrange for the check to observe a state that permits a transition that policy would otherwise deny. The attack requires local access and low privileges, with no user interaction, and results in high confidentiality and integrity impact.

No public proof-of-concept exploit is available. The upstream fixes are documented in kernel commits 4a9b165, 5b906f3, 82d3ace, and a010cad. See the Kernel Git Commit 4a9b165 for the reference implementation of the fix.

Detection Methods for CVE-2026-64111

Indicators of Compromise

No file-based indicators of compromise are published for this vulnerability, as exploitation occurs entirely in kernel memory through a legitimate syscall.
Unexpected SELinux AVC denials or AppArmor DENIED audit entries associated with lsm_set_self_attr transitions on kernels lacking the fix.
Unusual pairing of ptrace syscalls with lsm_set_self_attr invocations from the same process group in short time windows.

Detection Strategies

Enable kernel auditing for the lsm_set_self_attr syscall using auditctl rules and correlate with concurrent ptrace events from sibling threads or processes.
Alert when unprivileged processes attempt LSM self-attribute changes that result in security context transitions, particularly under SELinux unconfined_t to confined domain movement or AppArmor profile changes.
Baseline the set of binaries that legitimately call lsm_set_self_attr() on your fleet and flag deviations.

Monitoring Recommendations

Ingest kernel audit logs, SELinux AVC messages, and AppArmor audit events into a centralized logging pipeline for correlation.
Track kernel package versions across the fleet and flag hosts running kernels that predate the fix commits.
Monitor for ptrace activity from unprivileged processes targeting siblings, which is a common precondition for exploiting LSM race conditions.

How to Mitigate CVE-2026-64111

Immediate Actions Required

Inventory Linux hosts and identify kernels that lack the lsm_set_self_attr mutex fix from commits 4a9b165, 5b906f3, 82d3ace, and a010cad.
Apply vendor-supplied kernel updates from your distribution as soon as they are available and reboot affected hosts.
Restrict ptrace capabilities on production systems by setting kernel.yama.ptrace_scope=2 or higher where operationally acceptable.

Patch Information

The vulnerability is resolved upstream by acquiring cred_guard_mutex before invoking the LSM hook in lsm_set_self_attr(), matching the behavior of proc_pid_attr_write(). The fix is available in the following stable kernel commits: Kernel Git Commit 4a9b165, Kernel Git Commit 5b906f3, Kernel Git Commit 82d3ace, and Kernel Git Commit a010cad. Distribution maintainers backport these commits into supported kernel streams.

Workarounds

Tighten ptrace_scope via sysctl kernel.yama.ptrace_scope=2 to require CAP_SYS_PTRACE for attaching, which reduces the attack surface.
Restrict local access to trusted users on multi-tenant Linux hosts until kernels are patched.
Where feasible, disable or restrict the lsm_set_self_attr() syscall through seccomp profiles for containers and untrusted workloads.

bash

# Configuration example: harden ptrace and verify kernel version
sysctl -w kernel.yama.ptrace_scope=2
echo 'kernel.yama.ptrace_scope=2' >> /etc/sysctl.d/10-ptrace.conf

# Confirm the running kernel includes the fix
uname -r
rpm -q --changelog kernel | grep -i 'lsm_set_self_attr\|cred_guard_mutex' | head