CVE-2026-89766 - pidfd: hold exec_update_lock around namespace ioctl
Brief
CVE ID : CVE-2026-89766
Published : Sept. 11, 2026, 8:20 p. m.
- 32 minutes ago
Description : In the Linux kernel, the following vulnerability has been resolved:
pidfd: hold exec_update_lock around namespace ioctl
The PIDFD_GET_*_NAMESPACE ioctls in pidfd_ioctl() perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states that the code "mirrors nsfs behavior", but, unlike the corresponding procfs paths, it does so without holding the target task's exec_update_lock.
proc_ns_get_link() and proc_ns_readlink() both take exec_update_lock for reading around the ptrace check and the namespace lookup, so that the credentials used for the access decision match those of the task when its namespace is read.