{"id":"CVE-2026-64253","title":"kernel/fork: clear PF_BLOCK_TS in copy_process()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nkernel/fork: clear PF_BLOCK_TS in copy_process()\n\nPF_BLOCK_TS is only set in blk_time_get_ns() when current->plug is\nnon-NULL, and blk_finish_plug() clears it via __blk…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 06b23f92af87a84d70881b2ecaa72e00f7838264 < ee0801aceabdf583392477baf69a290b09448b8f","Linux >= 06b23f92af87a84d70881b2ecaa72e00f7838264 < 99e6c712cc300883b8cbf03347d5359ec1a4d6dd","Linux >= 06b23f92af87a84d70881b2ecaa72e00f7838264 < 77bba61a20f1b3d206f4f90e10a7bb3cd90b9619","Linux >= 06b23f92af87a84d70881b2ecaa72e00f7838264 < fd38b75c4b43295b10d69772a46d1c74dbd6fc81","Linux 6.9"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:33:07.473767Z"},"published":"2026-07-24","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:34:31.502Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64253","references":[{"url":"https://git.kernel.org/stable/c/ee0801aceabdf583392477baf69a290b09448b8f"},{"url":"https://git.kernel.org/stable/c/99e6c712cc300883b8cbf03347d5359ec1a4d6dd"},{"url":"https://git.kernel.org/stable/c/77bba61a20f1b3d206f4f90e10a7bb3cd90b9619"},{"url":"https://git.kernel.org/stable/c/fd38b75c4b43295b10d69772a46d1c74dbd6fc81"}],"tags":["cve.org"],"epss":0.00114,"epssPercentile":0.01485,"ingestedAt":"2026-11-06T16:57:43.215Z","slug":"CVE-2026-64253","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nkernel/fork: clear PF_BLOCK_TS in copy_process()\n\nPF_BLOCK_TS is only set in blk_time_get_ns() when current->plug is\nnon-NULL, and blk_finish_plug() clears it via __blk_flush_plug()\nbefore NULLing the plug pointer.  copy_process() breaks the\ninvariant by inheriting PF_BLOCK_TS from the parent while resetting\nthe child's plug to NULL.\n\nClear PF_BLOCK_TS alongside that assignment so callers can rely on\n\"PF_BLOCK_TS set implies current->plug != NULL\" and dereference\ncurrent->plug unguarded.\n\n## Affected\n\n- `Linux >= 06b23f92af87a84d70881b2ecaa72e00f7838264 < ee0801aceabdf583392477baf69a290b09448b8f`\n- `Linux >= 06b23f92af87a84d70881b2ecaa72e00f7838264 < 99e6c712cc300883b8cbf03347d5359ec1a4d6dd`\n- `Linux >= 06b23f92af87a84d70881b2ecaa72e00f7838264 < 77bba61a20f1b3d206f4f90e10a7bb3cd90b9619`\n- `Linux >= 06b23f92af87a84d70881b2ecaa72e00f7838264 < fd38b75c4b43295b10d69772a46d1c74dbd6fc81`\n- `Linux 6.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}