Answer in brief
CVE-2026-46259 records a High severity (CVSS 7.8) vulnerability in procfs: fix missing RCU protection when reading real_parent in do_task_stat(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=06fffb1267c9d986687b69d74a46ee332a50575e <fefa0fcd78be465b7ad4c497fa6ec90d64194c04 || >=06fffb1267c9d986687b69d74a46ee332a50575e <c93a33f28f915d446eea6fb3f0e1def0b3af1982 || >=06fffb1267c9d986687b69d74a46ee332a50575e <1c8dc5b5517546c68ffae40b948336122bb61306 || >=06fffb1267c9d986687b69d74a46ee332a50575e <0e64bd46a04a4fd61279aca9f53a664e9e5f7e7e || >=06fffb1267c9d986687b69d74a46ee332a50575e <73ec7c96601d61d52310c659145bb06d933a0fa6 || >=06fffb1267c9d986687b69d74a46ee332a50575e <4f9ae386861e280b7631ca252f798d25575627ee || >=06fffb1267c9d986687b69d74a46ee332a50575e <dd8b13cb4ff1a4545a214ed897fdf2bc341155b6 || >=06fffb1267c9d986687b69d74a46ee332a50575e <76149d53502cf17ef3ae454ff384551236fba867 | fefa0fcd78be465b7ad4c497fa6ec90d64194c04, c93a33f28f915d446eea6fb3f0e1def0b3af1982, 1c8dc5b5517546c68ffae40b948336122bb61306, 0e64bd46a04a4fd61279aca9f53a664e9e5f7e7e, 73ec7c96601d61d52310c659145bb06d933a0fa6, 4f9ae386861e280b7631ca252f798d25575627ee, dd8b13cb4ff1a4545a214ed897fdf2bc341155b6, 76149d53502cf17ef3ae454ff384551236fba867 |
| Linux/Linuxgeneric | 2.6.26 | Not reported |
Published upstream
Jun 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading real_parent in do_task_stat() When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- do_task_stat var = task->real_parent release_task call_rcu(delayed_put_task_struct) task_tgid_nr_ns(var) rcu_read_lock <--- Too late to protect task->real_parent! task_pid_ptr <--- UAF! rcu_read_unlock This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add proper RCU protection for accessing task->real_parent.
Quoted source text, attributed separately from HOL analysis.