CVE-2026-64253

PF_BLOCK_TS is only set in blk_time_get_ns() when current->plug is non-NULL, and blk_finish_plug() clears it via __blk_flush_plug() before NULLing the plug pointer. copy_process() breaks the invariant by inheriting PF_BLOCK_TS from the parent while resetting the child's plug to NULL.

Clear PF_BLOCK_TS alongside that assignment so callers can rely on "PF_BLOCK_TS set implies current->plug != NULL" and dereference current->plug unguarded.

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64253.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

06b23f92af87a84d70881b2ecaa72e00f7838264

Fixed

ee0801aceabdf583392477baf69a290b09448b8f

Fixed

99e6c712cc300883b8cbf03347d5359ec1a4d6dd

Fixed

77bba61a20f1b3d206f4f90e10a7bb3cd90b9619

Fixed

fd38b75c4b43295b10d69772a46d1c74dbd6fc81

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-64253.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.9.0

Fixed

6.12.95

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.18.38

Type: ECOSYSTEM
Events: Introduced

6.19.0

Fixed

7.1.3

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-64253.json"