CVE-2026-64375 Overview
CVE-2026-64375 is a race condition in the Linux kernel's /proc filesystem handling of file descriptor symbolic links. The flaw resides in proc_pid_get_link() and proc_pid_readlink(), which look up a task from a PID twice: once for the ptrace_may_access() permission check and again for the actual access. Because the task pointer is resolved separately for the check and the operation, a local attacker can race the two lookups to bypass ptrace access controls. Successful exploitation permits unauthorized read of another process's file descriptor links, potentially exposing sensitive resources.
Critical Impact
A local, low-privileged user can win the race between the ptrace permission check and the follow-up task resolution to access file descriptor links belonging to processes they should not be able to inspect.
Affected Products
- Linux kernel (upstream) — fs/proc subsystem
- Stable kernel branches referenced by the fix commits 138c692, 497c6ba, 6253dfe, 6255da2, 65bf0d2, 83b1787, de497d7, and dfd1894
- Linux distributions shipping kernels prior to inclusion of the referenced backports
Discovery Timeline
- 2026-07-25 - CVE-2026-64375 published to NVD
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-64375
Vulnerability Analysis
The vulnerability is a time-of-check to time-of-use (TOCTOU) race condition [CWE-367] in the procfs code paths that resolve PID-based file descriptor links. proc_pid_get_link() and proc_pid_readlink() resolve the target task from its PID, run ptrace_may_access() against that task, and then look up the task a second time to perform the actual link retrieval. Between the two lookups the task state can change, including credential transitions triggered by execve().
An attacker with local shell access can leverage this window to read /proc/<pid>/fd/* symbolic links for a process whose credentials would otherwise deny access. The exposed link targets may reveal file paths, socket descriptors, and pipe endpoints tied to privileged processes.
Root Cause
The root cause is inconsistent task acquisition. The permission check and the follow-up dereference are not serialized against exec_update_lock, so the credentials or executable evaluated during ptrace_may_access() do not necessarily correspond to the task ultimately acted upon. The upstream fix passes the task directly to the ->proc_get_link() handler and introduces a new helper, call_proc_get_link(), that performs the lookup, holds exec_update_lock, runs the access check, and invokes ->proc_get_link() atomically.
Attack Vector
Exploitation requires local access with the ability to execute code as an unprivileged user. The attacker repeatedly triggers reads of another process's /proc/<pid>/fd/N entries while that target process performs execve() transitions to SUID or otherwise privileged binaries. Winning the race collapses the check-then-use gap and permits the operation to complete against a task whose credentials should have denied it. See the referenced kernel commits for the full patch series and functional details.
Detection Methods for CVE-2026-64375
Indicators of Compromise
- Unexpected or high-frequency readlink and open syscalls against /proc/<pid>/fd/* paths originating from unprivileged users
- Processes issuing tight loops of openat(AT_FDCWD, "/proc/<pid>/...") targeting SUID binaries or system daemons
- Kernel audit records showing repeated ptrace_may_access denials followed shortly by successful proc accesses to the same PID
Detection Strategies
- Enable auditd rules on /proc/*/fd access and correlate reads by non-root users against sensitive PIDs such as sshd, sudo, and setuid utilities
- Deploy Linux Security Module (LSM) policies (SELinux, AppArmor) that constrain proc_fd_access for untrusted users and log denials
- Hunt for scripted or compiled binaries invoking readlinkat on /proc/<pid>/fd/* at abnormally high rates, a pattern consistent with race-window exploitation
Monitoring Recommendations
- Ingest kernel AVC and audit logs into a centralized SIEM and alert on bursts of proc-fs access failures immediately preceding successes
- Track execve() events for SUID binaries alongside concurrent proc reads from the same UID to surface race-oriented behavior
- Monitor for unpatched kernel versions across the fleet using package inventory data and flag hosts missing the fix commits
How to Mitigate CVE-2026-64375
Immediate Actions Required
- Apply the vendor-supplied kernel update that incorporates the upstream commits 138c692, 497c6ba, 6253dfe, 6255da2, 65bf0d2, 83b1787, de497d7, or dfd1894 for the corresponding stable branch
- Reboot systems after patch installation to load the fixed kernel image
- Prioritize multi-tenant hosts, shared build servers, and any system permitting untrusted local shell access
Patch Information
The fix passes the resolved task into the ->proc_get_link() handler and introduces call_proc_get_link(), which locks the task via exec_update_lock before performing the ptrace_may_access() check and the link operation. See the Kernel Commit 138c692, Kernel Commit 497c6ba, Kernel Commit 6253dfe, Kernel Commit 6255da2, Kernel Commit 65bf0d2, Kernel Commit 83b1787, Kernel Commit de497d7, and Kernel Commit dfd1894 for the authoritative fixes.
Workarounds
- Restrict local shell access on multi-tenant systems and remove unnecessary SUID binaries to reduce exploitable race targets
- Tighten kernel.yama.ptrace_scope to 2 or 3 via sysctl to constrain ptrace-based operations across processes
- Enforce mandatory access control policies (SELinux, AppArmor) that block unprivileged reads of /proc/<pid>/fd/* for sensitive services
# Configuration example
# Restrict ptrace scope system-wide
sysctl -w kernel.yama.ptrace_scope=2
echo 'kernel.yama.ptrace_scope = 2' > /etc/sysctl.d/10-ptrace.conf
# Verify running kernel includes the fix
uname -r
rpm -q --changelog kernel | grep -E '138c692|497c6ba|6253dfe|6255da2|65bf0d2|83b1787|de497d7|dfd1894'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
