In the Linux kernel, the following vulnerability has been resolved:
procfs: fix missing RCU protection when reading realparent in dotask_stat()
When reading /proc/[pid]/stat, dotaskstat() accesses task->real_parent without proper RCU protection, which leads to:
cpu 0 cpu 1 ----- ----- dotaskstat var = task->realparent releasetask callrcu(delayedputtaskstruct) tasktgidnrns(var) rcureadlock <--- Too late to protect task->realparent! taskpidptr <--- UAF! rcureadunlock
This patch uses taskppidnrns() instead of tasktgidnrns() to add proper RCU protection for accessing task->real_parent.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46259.json",
"cna_assigner": "Linux"
}