CVE-2026-64375: proc: protect ptrace_may_access() with exec_update_lock (FD links)

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

proc: protect ptrace_may_access() with exec_update_lock (FD links)

proc_pid_get_link() and proc_pid_readlink() currently look up the task from
the pid once, then do the ptrace access check on that task, then look up
the task from the pid a second time to do the actual access.
That's racy in several ways.

To fix it, pass the task to the ->proc_get_link() handler, and instead of
proc_fd_access_allowed(), introduce a new helper call_proc_get_link() that
looks up and locks the task, does the access check, and calls
->proc_get_link().

The Linux kernel CVE team has assigned CVE-2026-64375 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.18 with commit 778c1144771f0064b6f51bee865cceb0d996f2f9 and fixed in 5.10.261 with commit 6253dfee5afba536bb54fc6fe6c091c3758fafe1
	Issue introduced in 2.6.18 with commit 778c1144771f0064b6f51bee865cceb0d996f2f9 and fixed in 5.15.212 with commit 65bf0d2b6e914f1448d6a2fde193dcf60936a651
	Issue introduced in 2.6.18 with commit 778c1144771f0064b6f51bee865cceb0d996f2f9 and fixed in 6.1.178 with commit de497d7aa2fae453a7e7c8f7d3e8682e565e3aaf
	Issue introduced in 2.6.18 with commit 778c1144771f0064b6f51bee865cceb0d996f2f9 and fixed in 6.6.145 with commit 138c692d2b2d63d26f2eb957d0e4fcc5d61f9ff2
	Issue introduced in 2.6.18 with commit 778c1144771f0064b6f51bee865cceb0d996f2f9 and fixed in 6.12.97 with commit 83b17872e3166c295c599279fc9562ac3840c638
	Issue introduced in 2.6.18 with commit 778c1144771f0064b6f51bee865cceb0d996f2f9 and fixed in 6.18.40 with commit 497c6bae5167428596575f20af6613ff5671f383
	Issue introduced in 2.6.18 with commit 778c1144771f0064b6f51bee865cceb0d996f2f9 and fixed in 7.1.4 with commit dfd1894cb64cbd8758b461ed713800fe73db4f82
	Issue introduced in 2.6.18 with commit 778c1144771f0064b6f51bee865cceb0d996f2f9 and fixed in 7.2-rc1 with commit 6255da28d4bb5349fe18e84cb043ccd394eba75d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64375
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/proc/base.c
	fs/proc/fd.c
	fs/proc/internal.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/6253dfee5afba536bb54fc6fe6c091c3758fafe1
	https://git.kernel.org/stable/c/65bf0d2b6e914f1448d6a2fde193dcf60936a651
	https://git.kernel.org/stable/c/de497d7aa2fae453a7e7c8f7d3e8682e565e3aaf
	https://git.kernel.org/stable/c/138c692d2b2d63d26f2eb957d0e4fcc5d61f9ff2
	https://git.kernel.org/stable/c/83b17872e3166c295c599279fc9562ac3840c638
	https://git.kernel.org/stable/c/497c6bae5167428596575f20af6613ff5671f383
	https://git.kernel.org/stable/c/dfd1894cb64cbd8758b461ed713800fe73db4f82
	https://git.kernel.org/stable/c/6255da28d4bb5349fe18e84cb043ccd394eba75d