CVE-2026-63865 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks
bpf_lsm_task_to_inode() is called under rcu_read_lock() and bpf_lsm_inet_conn_established() is called from softirq context, so neither hook can be used by sleepable LSM programs.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability addressed in this linux kernel update relates to improper handling of security module hooks within the eBPF framework, specifically affecting loadable security modules that operate under certain kernel contexts. This issue stems from the incorrect exposure of specific lsm hooks to sleepable bpf programs despite their execution contexts being incompatible with such operations. The bpf_lsm_task_to_inode() function executes under rcu_read_lock() which prevents sleeping operations, while bpf_lsm_inet_conn_established() runs from softirq context where blocking is not permitted. These execution constraints create a fundamental incompatibility between the hook interfaces and sleepable bpf program requirements that could potentially lead to system instability or security concerns when improperly utilized.
The technical flaw manifests in how the kernel's security module framework interacts with eBPF programs designed to operate in sleepable contexts. When lsm hooks are exposed to sleepable programs, they create scenarios where programs might attempt to perform operations that cannot be completed within the constrained execution environments of rcu_read_lock() or softirq contexts. This represents a violation of fundamental kernel execution model principles where certain contexts have strict limitations on what operations can occur, particularly those involving sleeping or blocking behavior that could compromise system responsiveness and stability.
The operational impact of this vulnerability extends to systems relying on eBPF-based security monitoring and enforcement mechanisms. When sleepable bpf programs attempt to utilize these hooks, the kernel's runtime behavior becomes unpredictable as it tries to reconcile incompatible execution contexts. This could result in system hangs, deadlocks, or unexpected program termination during security event processing. The issue particularly affects network security monitoring and access control implementations that depend on tracking inode relationships and connection establishment events through bpf programs.
Mitigation strategies involve ensuring that eBPF programs targeting sleepable lsm hooks only utilize interfaces compatible with their execution contexts. System administrators should review existing bpf security modules to verify they do not attempt to use task_to_inode or inet_conn_established hooks in sleepable contexts. The kernel update effectively prevents these problematic hook exposures by removing them from the set of available interfaces for sleepable lsm programs, thereby enforcing proper context boundaries. This aligns with established security principles where execution context constraints must be respected to maintain system integrity and prevent denial of service conditions.
This vulnerability demonstrates a classic example of improper abstraction boundary enforcement in kernel security frameworks and relates to common weakness enumerations such as CWE-691, which addresses insufficient control flow management in security modules. The fix implements proper context validation mechanisms that align with attack mitigation techniques described in the mitre attack framework under tactics related to privilege escalation and execution flow manipulation. The resolution ensures that bpf programs operating in sleepable contexts cannot inadvertently access kernel interfaces that would violate their fundamental execution constraints, thereby maintaining the kernel's security model integrity while preserving legitimate use cases for proper hook implementations.