Linux kernel PF_BLOCK_TS flag misinheritance during fork()
CVE-2026-64253 Published on July 24, 2026
kernel/fork: clear PF_BLOCK_TS in copy_process()
In the Linux kernel, the following vulnerability has been resolved:
kernel/fork: clear PF_BLOCK_TS in copy_process()
PF_BLOCK_TS is only set in blk_time_get_ns() when current->plug is
non-NULL, and blk_finish_plug() clears it via __blk_flush_plug()
before NULLing the plug pointer. copy_process() breaks the
invariant by inheriting PF_BLOCK_TS from the parent while resetting
the child's plug to NULL.
Clear PF_BLOCK_TS alongside that assignment so callers can rely on
"PF_BLOCK_TS set implies current->plug != NULL" and dereference
current->plug unguarded.
Products Associated with CVE-2026-64253
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 06b23f92af87a84d70881b2ecaa72e00f7838264 and below ee0801aceabdf583392477baf69a290b09448b8f is affected.
- Version 06b23f92af87a84d70881b2ecaa72e00f7838264 and below 99e6c712cc300883b8cbf03347d5359ec1a4d6dd is affected.
- Version 06b23f92af87a84d70881b2ecaa72e00f7838264 and below 77bba61a20f1b3d206f4f90e10a7bb3cd90b9619 is affected.
- Version 06b23f92af87a84d70881b2ecaa72e00f7838264 and below fd38b75c4b43295b10d69772a46d1c74dbd6fc81 is affected.
- Version 6.9 is affected.
- Before 6.9 is unaffected.
- Version 6.12.95, <= 6.12.* is unaffected.
- Version 6.18.38, <= 6.18.* is unaffected.
- Version 7.1.3, <= 7.1.* is unaffected.
- Version 7.2-rc1, <= * is unaffected.