Linux Kernel EUVD-2026-48915

exec_update_lock is a read-write semaphore in the Linux kernel that serializes access to a task's credentials and memory maps during an execve() call, preventing any reader from observing the half-replaced process image. ptrace_may_access() evaluates whether a caller has permission to inspect a target process by reading credential structures that are transiently replaced during exec. Six procfs callback functions - do_task_stat(), proc_pid_wchan(), proc_map_files_lookup(), proc_map_files_readdir(), proc_ns_get_link(), and proc_ns_readlink() - invoked ptrace_may_access() or get_task_mm() without first acquiring exec_update_lock, creating a TOCTOU race window. The kernel fix either adds an exec_update_lock read-lock guard around the ptrace_may_access() call (for do_task_stat, proc_pid_wchan, proc_ns_get_link, proc_ns_readlink) or replaces get_task_mm() with mm_access() (for proc_map_files_lookup, proc_map_files_readdir), which internally handles locking correctly. NVD has not assigned a CWE; CWE-362 (Concurrent Execution Using Shared Resource With Improper Synchronization) and CWE-667 (Improper Locking) are the most applicable classes, inferred from the description.