CVE-2026-63865: Linux

High severity, CVSS 8.8. EPSS: 0.1% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks bpf_lsm_task_to_inode() is called under rcu_read_lock() and bpf_lsm_inet_conn_established() is called from softirq context, so neither hook can be used by sleepable LSM programs.

Affected products

• Linux Linux: from 5.11, before 5.15.209 (fixed in 5.15.209); from 5.16, before 6.1.175 (fixed in 6.1.175); from 6.2, before 6.6.141 (fixed in 6.6.141); from 6.7, before 6.12.91 (fixed in 6.12.91); from 6.13, before 6.18.33 (fixed in 6.18.33); from 6.19, before 7.0.10 (fixed in 7.0.10)

Published 2026-07-19. Last modified 2026-07-27.