Re: [PATCH] pidfd: hold exec_update_lock around namespace ioctl

Chen Linxuan <[email protected]> Sat, 1 Aug 2026 14:28:42 +0800

Newsgroups	org.kernel.vger.linux-fsdevel,org.kernel.vger.linux-kernel,org.kernel.vger.stable
Message-ID	<CAC1kPDNd3KTpFJduy2YopaxH2WYFZm9BTcjcx-oaT+nsMkXd0g@mail.gmail.com>

On Fri, Jul 31, 2026 at 10:50 PM Chen Linxuan via B4 Relay
<[email protected]> wrote:
>
> From: Chen Linxuan <[email protected]>
>
> The PIDFD_GET_*_NAMESPACE ioctls in pidfd_ioctl() perform a filesystem
> credentials ptrace access check before handing out a namespace file
> descriptor.  The accompanying comment states that the code "mirrors nsfs
> behavior", but, unlike the corresponding procfs paths, it does so without
> holding the target task's exec_update_lock.

After sending v1 I realised that the exec_update_lock in the procfs namespace
paths was just added by commit 6650527444da to fix CVE-2026-64371.
So the pidfd PIDFD_GET_*_NAMESPACE ioctls, which mirror those procfs
paths, should be fixed the same way.

CC Jann.