---
id: CVE-2026-64253
title: 'kernel/fork: clear PF_BLOCK_TS in copy_process()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  kernel/fork: clear PF_BLOCK_TS in copy_process()

  PF_BLOCK_TS is only set in blk_time_get_ns() when current->plug is
  non-NULL, and blk_finish_plug() clears it via __blk…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 06b23f92af87a84d70881b2ecaa72e00f7838264 <
    ee0801aceabdf583392477baf69a290b09448b8f
  - >-
    Linux >= 06b23f92af87a84d70881b2ecaa72e00f7838264 <
    99e6c712cc300883b8cbf03347d5359ec1a4d6dd
  - >-
    Linux >= 06b23f92af87a84d70881b2ecaa72e00f7838264 <
    77bba61a20f1b3d206f4f90e10a7bb3cd90b9619
  - >-
    Linux >= 06b23f92af87a84d70881b2ecaa72e00f7838264 <
    fd38b75c4b43295b10d69772a46d1c74dbd6fc81
  - Linux 6.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:33:07.473767Z'
published: '2026-07-24'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:34:31.502Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64253'
references:
  - url: 'https://git.kernel.org/stable/c/ee0801aceabdf583392477baf69a290b09448b8f'
  - url: 'https://git.kernel.org/stable/c/99e6c712cc300883b8cbf03347d5359ec1a4d6dd'
  - url: 'https://git.kernel.org/stable/c/77bba61a20f1b3d206f4f90e10a7bb3cd90b9619'
  - url: 'https://git.kernel.org/stable/c/fd38b75c4b43295b10d69772a46d1c74dbd6fc81'
tags:
  - cve.org
epss: 0.00114
epssPercentile: 0.01485
ingestedAt: '2026-11-06T16:57:43.215Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

kernel/fork: clear PF_BLOCK_TS in copy_process()

PF_BLOCK_TS is only set in blk_time_get_ns() when current->plug is
non-NULL, and blk_finish_plug() clears it via __blk_flush_plug()
before NULLing the plug pointer.  copy_process() breaks the
invariant by inheriting PF_BLOCK_TS from the parent while resetting
the child's plug to NULL.

Clear PF_BLOCK_TS alongside that assignment so callers can rely on
"PF_BLOCK_TS set implies current->plug != NULL" and dereference
current->plug unguarded.

## Affected

- `Linux >= 06b23f92af87a84d70881b2ecaa72e00f7838264 < ee0801aceabdf583392477baf69a290b09448b8f`
- `Linux >= 06b23f92af87a84d70881b2ecaa72e00f7838264 < 99e6c712cc300883b8cbf03347d5359ec1a4d6dd`
- `Linux >= 06b23f92af87a84d70881b2ecaa72e00f7838264 < 77bba61a20f1b3d206f4f90e10a7bb3cd90b9619`
- `Linux >= 06b23f92af87a84d70881b2ecaa72e00f7838264 < fd38b75c4b43295b10d69772a46d1c74dbd6fc81`
- `Linux 6.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.