Strix
26.1K

CVE-2026-63865

HIGHCVSS 8.8/10EPSS 0.12%

Last modified

CVE-2026-63865 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks bpf_lsm_task_to_inode() is called under rcu_read_lock() and bpf_lsm_inet_conn_established() is called from softirq context, so neither hook can be used by sleepable LSM programs.. EPSS estimates a 0.12% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks bpf_lsm_task_to_inode() is called under rcu_read_lock() and bpf_lsm_inet_conn_established() is called from softirq context, so neither hook can be used by sleepable LSM programs.

Metrics

CVSS 3.1
8.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Probability
0.12%

2.3th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 423f16108c9d832bd96059d5c882c8ef6d76eb96, < 452a927cddcd67478d030e646f41cb904a93156f; >= 423f16108c9d832bd96059d5c882c8ef6d76eb96, < f0fc2a9828171205244a28013f02889f50b71c9f; >= 423f16108c9d832bd96059d5c882c8ef6d76eb96, < 26b380a3ca0b605fd8860995ed6a208f276dd316; >= 423f16108c9d832bd96059d5c882c8ef6d76eb96, < 0d918263c9bfc86078edb2e2f7302a0c6ce42b7c; >= 423f16108c9d832bd96059d5c882c8ef6d76eb96, < 281f2a214565a5cbf8b7355a65738d80bd19b8c5; >= 423f16108c9d832bd96059d5c882c8ef6d76eb96, < 989f1b93907de1753a814996222da375f07e579b; >= 423f16108c9d832bd96059d5c882c8ef6d76eb96, < beaf0e96b1da74549a6cabd040f9667d83b2e97e
LinuxLinux5.11

References

Timeline

Published
Last Modified
Status
Awaiting Analysis

Frequently Asked Questions

What is CVE-2026-63865?
In the Linux kernel, the following vulnerability has been resolved: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks bpf_lsm_task_to_inode() is called under rcu_read_lock() and bpf_lsm_inet_conn_established() is called from softirq context, so neither hook can be used by sleepable LSM programs.
How severe is CVE-2026-63865?
CVE-2026-63865 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 0.12% probability of exploitation in the next 30 days.
How do I fix CVE-2026-63865?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-63865?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST