{"id":"CVE-2026-63865","summary":"bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks\n\nbpf_lsm_task_to_inode() is called under rcu_read_lock() and\nbpf_lsm_inet_conn_established() is called from softirq context, so\nneither hook can be used by sleepable LSM programs.","modified":"2026-07-22T03:31:56.947892673Z","published":"2026-07-19T14:04:51.215Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63865.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0d918263c9bfc86078edb2e2f7302a0c6ce42b7c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/26b380a3ca0b605fd8860995ed6a208f276dd316"},{"type":"WEB","url":"https://git.kernel.org/stable/c/281f2a214565a5cbf8b7355a65738d80bd19b8c5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/452a927cddcd67478d030e646f41cb904a93156f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/989f1b93907de1753a814996222da375f07e579b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/beaf0e96b1da74549a6cabd040f9667d83b2e97e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f0fc2a9828171205244a28013f02889f50b71c9f"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63865.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63865"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"423f16108c9d832bd96059d5c882c8ef6d76eb96"},{"fixed":"452a927cddcd67478d030e646f41cb904a93156f"},{"fixed":"f0fc2a9828171205244a28013f02889f50b71c9f"},{"fixed":"26b380a3ca0b605fd8860995ed6a208f276dd316"},{"fixed":"0d918263c9bfc86078edb2e2f7302a0c6ce42b7c"},{"fixed":"281f2a214565a5cbf8b7355a65738d80bd19b8c5"},{"fixed":"989f1b93907de1753a814996222da375f07e579b"},{"fixed":"beaf0e96b1da74549a6cabd040f9667d83b2e97e"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-63865.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.209"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.175"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.141"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.91"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.33"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.10"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-63865.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}