CVE-2026-64111

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64111", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.035Z", "datePublished": "2026-07-19T15:40:13.007Z", "dateUpdated": "2026-08-05T12:39:20.048Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:39:20.048Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlsm: hold cred_guard_mutex for lsm_set_self_attr()\n\nJust as proc_pid_attr_write() already does before calling the LSM\nhook. This only matters for SELinux and AppArmor which check\nwhether the process is being ptraced and if so, whether to\nallow the transition."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires invoking the `lsm_set_self_attr` syscall (NR 460), which is strictly a local kernel entry point with no network, adjacent-wireless, or physical-device path to the vulnerable code.\nAC:L - The bug is a TOCTOU race between `lsm_set_self_attr` and concurrent ptrace attach/detach; an attacker can control both the tracee thread issuing the syscall and a tracer thread (e.g., via fork/PTRACE_TRACEME), making the race reliably winnable without conditions outside attacker control.\nPR:L - Any unprivileged local user can reach `sys_lsm_set_self_attr`; there is no capability or root requirement at the syscall boundary, and ptrace coordination is achievable within the same UID via standard unprivileged ptrace APIs.\nUI:N - Exploitation does not require any action from a separate victim user such as opening a file or mounting a filesystem; the attacker drives both the setattr syscall and the ptrace race directly.\nS:U - Successful exploitation changes the calling process's LSM credentials within the same kernel/OS security authority (SELinux domain or AppArmor profile transition), constituting standard local MAC bypass rather than crossing a VM, container-host, or IOMMU boundary.\nC:H - Bypassing the ptrace-mediated transition check allows committing a new SELinux SID or AppArmor profile without tracer authorization, granting read access to data and resources denied under the prior confined context.\nI:H - The attack culminates in `commit_creds()` with an unauthorized LSM security context (SELinux `crsec->sid` or AppArmor label replacement), constituting arbitrary modification of the process's mandatory access control identity and associated permissions.\nA:N - The vulnerability is a missing mutex enabling a policy-bypass race; it does not involve memory corruption, kernel oops, panic, hang, or other availability-impacting failure modes."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["security/lsm_syscalls.c"], "versions": [{"version": "a04a1198088a1378d0389c250cc684f649bcc91e", "lessThan": "82d3acee88593e3d9e71cad4b7d6b3cf70de9d07", "status": "affected", "versionType": "git"}, {"version": "a04a1198088a1378d0389c250cc684f649bcc91e", "lessThan": "5b906f31e977286888a9e31282589b545b249139", "status": "affected", "versionType": "git"}, {"version": "a04a1198088a1378d0389c250cc684f649bcc91e", "lessThan": "a010cadaf5727b8417f62fe9021fcef14a5f9b51", "status": "affected", "versionType": "git"}, {"version": "a04a1198088a1378d0389c250cc684f649bcc91e", "lessThan": "4a9b16541ad3faf8bccb398532bf3f8b6bbf1188", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["security/lsm_syscalls.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.92", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.34", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.92"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.18.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/82d3acee88593e3d9e71cad4b7d6b3cf70de9d07"}, {"url": "https://git.kernel.org/stable/c/5b906f31e977286888a9e31282589b545b249139"}, {"url": "https://git.kernel.org/stable/c/a010cadaf5727b8417f62fe9021fcef14a5f9b51"}, {"url": "https://git.kernel.org/stable/c/4a9b16541ad3faf8bccb398532bf3f8b6bbf1188"}], "title": "lsm: hold cred_guard_mutex for lsm_set_self_attr()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["security/lsm_syscalls.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "82d3acee88593e3d9e71cad4b7d6b3cf70de9d07", "status": "affected", "version": "a04a1198088a1378d0389c250cc684f649bcc91e", "versionType": "git"}, {"lessThan": "5b906f31e977286888a9e31282589b545b249139", "status": "affected", "version": "a04a1198088a1378d0389c250cc684f649bcc91e", "versionType": "git"}, {"lessThan": "a010cadaf5727b8417f62fe9021fcef14a5f9b51", "status": "affected", "version": "a04a1198088a1378d0389c250cc684f649bcc91e", "versionType": "git"}, {"lessThan": "4a9b16541ad3faf8bccb398532bf3f8b6bbf1188", "status": "affected", "version": "a04a1198088a1378d0389c250cc684f649bcc91e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["security/lsm_syscalls.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.92", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.34", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D75E3039-FE9D-4A41-9204-A2E1CBC948C9", "versionEndExcluding": "6.12.92", "versionStartIncluding": "6.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A4B1EF6D-18D7-4838-BC37-7499D5DCC3C0", "versionEndExcluding": "6.18.34", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750", "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlsm: hold cred_guard_mutex for lsm_set_self_attr()\n\nJust as proc_pid_attr_write() already does before calling the LSM\nhook. This only matters for SELinux and AppArmor which check\nwhether the process is being ptraced and if so, whether to\nallow the transition."}], "id": "CVE-2026-64111", "lastModified": "2026-08-12T15:50:39.560", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-07-19T16:17:52.463", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4a9b16541ad3faf8bccb398532bf3f8b6bbf1188"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5b906f31e977286888a9e31282589b545b249139"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/82d3acee88593e3d9e71cad4b7d6b3cf70de9d07"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a010cadaf5727b8417f62fe9021fcef14a5f9b51"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: lsm: hold cred_guard_mutex for lsm_set_self_attr()", "id": "2502490", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502490"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-412", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nlsm: hold cred_guard_mutex for lsm_set_self_attr()\nJust as proc_pid_attr_write() already does before calling the LSM\nhook. This only matters for SELinux and AppArmor which check\nwhether the process is being ptraced and if so, whether to\nallow the transition.", "A flaw was found in the Linux kernel's Security Module (LSM). A local attacker could exploit this vulnerability by leveraging an improper handling of a credential guard mutex in the `lsm_set_self_attr()` function. This oversight may allow the attacker to bypass security restrictions enforced by modules such as SELinux and AppArmor when a process is being debugged, potentially leading to unauthorized access or privilege escalation."], "name": "CVE-2026-64111", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "impact": "important", "package_name": "erlang27", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64111\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64111\nhttps://lore.kernel.org/linux-cve-announce/2026071922-CVE-2026-64111-6b23@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a04a1198088a1378d0389c250cc684f649bcc91e,82d3acee88593e3d9e71cad4b7d6b3cf70de9d07)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a04a1198088a1378d0389c250cc684f649bcc91e,5b906f31e977286888a9e31282589b545b249139)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a04a1198088a1378d0389c250cc684f649bcc91e,a010cadaf5727b8417f62fe9021fcef14a5f9b51)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a04a1198088a1378d0389c250cc684f649bcc91e,4a9b16541ad3faf8bccb398532bf3f8b6bbf1188)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.92,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.34,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.11,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T10:45:02.435833+00:00", "updated": "2026-08-13T13:00:04.983917+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}