CVE-2026-46259: procfs: fix missing RCU protection when reading real_parent in do_task_stat()

Synopsis

A use-after-free bug in the Linux kernel's procfs subsystem allows a local attacker to exploit a race condition when reading /proc/[pid]/stat. The vulnerability is reachable locally and requires only a low-privilege account, with no victim interaction needed. Successful exploitation gives the attacker full read, write, and crash capability over the affected kernel, including arbitrary memory reads of sensitive data, memory corruption, and a kernel crash. Patched-image rebuilds at the fix commits (including the 5.10.252 stable release) are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the race condition via repeated reads of /proc/[pid]/stat.

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the race condition entirely on their own.

• Attack complexityDetail

  Attack complexity is rated Low, meaning the race window is reliably exploitable without requiring special memory layout, timing precision beyond a standard race loop, or other environmental preconditions.

Blast Radius

• A successful attacker reads arbitrary kernel memory, exposing credentials, cryptographic keys, and other sensitive data held in kernel structures.
• The attacker writes to freed kernel memory, corrupting kernel data structures and enabling privilege escalation to root.
• The corrupted kernel state can crash the host, taking down all containers and workloads running on the affected node.
• Because the bug lives in the kernel shared by all containers on a node, a compromised container could affect workloads belonging to other tenants on the same host.