Improper access control in Linux kernel - CVE-2026-46104

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU133088

Improper access control in Linux kernel - CVE-2026-46104

Published: May 29, 2026


Vulnerability identifier: #VU133088
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-46104
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to bypass SELinux socket permission checks.

The vulnerability exists due to improper access control in sock_has_perm() and nlmsg_sock_has_extended_perms() when handling socket permission checks in stacked LSM configurations. A local user can trigger access checks on a socket with an incorrectly interpreted security blob to bypass SELinux socket permission checks.

The issue occurs when another LSM allocates socket blob storage before SELinux, causing invalid SID and class values to be used in AVC checks.


Affected software

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-ibm (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-azure (Ubuntu package)
linux-aws (Ubuntu package)

How to mitigate CVE-2026-46104

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - addressed in versions 7.0.0-28.28, 7.0.0-28.28.1, 7.0.0-1003.4, 7.0.0-1008.8
linux-ibm (Ubuntu package) - addressed in versions 7.0.0-1008.8, 7.0.0-1010.10
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1009.9
linux-azure (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1010.10
linux-aws (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1015.15

External References

Related Security Bulletins