Linux Kernel: RCU Protection Gap in /proc/[pid]/stat Hides UAF
CVE-2026-46259 Published on June 3, 2026
procfs: fix missing RCU protection when reading real_parent in do_task_stat()
In the Linux kernel, the following vulnerability has been resolved:
procfs: fix missing RCU protection when reading real_parent in do_task_stat()
When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent
without proper RCU protection, which leads to:
cpu 0 cpu 1
----- -----
do_task_stat
var = task->real_parent
release_task
call_rcu(delayed_put_task_struct)
task_tgid_nr_ns(var)
rcu_read_lock <--- Too late to protect task->real_parent!
task_pid_ptr <--- UAF!
rcu_read_unlock
This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add
proper RCU protection for accessing task->real_parent.
Products Associated with CVE-2026-46259
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 06fffb1267c9d986687b69d74a46ee332a50575e and below fefa0fcd78be465b7ad4c497fa6ec90d64194c04 is affected.
- Version 06fffb1267c9d986687b69d74a46ee332a50575e and below c93a33f28f915d446eea6fb3f0e1def0b3af1982 is affected.
- Version 06fffb1267c9d986687b69d74a46ee332a50575e and below 1c8dc5b5517546c68ffae40b948336122bb61306 is affected.
- Version 06fffb1267c9d986687b69d74a46ee332a50575e and below 0e64bd46a04a4fd61279aca9f53a664e9e5f7e7e is affected.
- Version 06fffb1267c9d986687b69d74a46ee332a50575e and below 73ec7c96601d61d52310c659145bb06d933a0fa6 is affected.
- Version 06fffb1267c9d986687b69d74a46ee332a50575e and below 4f9ae386861e280b7631ca252f798d25575627ee is affected.
- Version 06fffb1267c9d986687b69d74a46ee332a50575e and below dd8b13cb4ff1a4545a214ed897fdf2bc341155b6 is affected.
- Version 06fffb1267c9d986687b69d74a46ee332a50575e and below 76149d53502cf17ef3ae454ff384551236fba867 is affected.
- Version 2.6.26 is affected.
- Before 2.6.26 is unaffected.
- Version 5.10.252, <= 5.10.* is unaffected.
- Version 5.15.202, <= 5.15.* is unaffected.
- Version 6.1.165, <= 6.1.* is unaffected.
- Version 6.6.128, <= 6.6.* is unaffected.
- Version 6.12.75, <= 6.12.* is unaffected.
- Version 6.18.14, <= 6.18.* is unaffected.
- Version 6.19.4, <= 6.19.* is unaffected.
- Version 7.0, <= * is unaffected.