{"id":"CVE-2026-46333","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nptrace: slightly saner 'get_dumpable()' logic\n\nThe 'dumpability' of a task is fundamentally about the memory image of\nthe task - the concept comes from whether it can c…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nptrace: slightly saner 'get_dumpable()' logic\n\nThe 'dumpability' of a task is fundamentally about the memory image of\nthe task - the concept comes from whether it can c…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-269"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 3.16.52, < 3.17","linux_kernel >= 4.4.40, < 4.5","linux_kernel >= 4.8.16, < 4.9","linux_kernel >= 4.9.1, < 5.10.256","linux_kernel >= 5.11, < 5.15.207","linux_kernel >= 5.16, < 6.1.173","linux_kernel >= 6.2, < 6.6.139","linux_kernel >= 6.7, < 6.12.89","linux_kernel >= 6.13, < 6.18.31","linux_kernel >= 6.19, < 7.0.8","linux_kernel = 7.1","debian_linux = 11.0"],"patched":["linux_kernel 7.0.8"],"published":"2026-05-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T02:19:54.770","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46333","references":[{"url":"https://git.kernel.org/stable/c/01363cb3fbd0238ffdeb09f53e9039c9edf8a730","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/15b828a46f305ae9f05a7c16914b3ce273474205","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2a93a4fac7b6051d3be7cd1b015fe7320cd0404d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4709234fd1b95136ceb789f639b1e7ea5de1b181","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e5b51e74a40d377bcd3081dd33fbaa0e1aa7e3d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8f907d345bae8f4b3f004c5abc56bf2dfb851ea7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/93d4ba49d18e3d7fb41a9927c2d0cca5e9dfefd6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"http://www.openwall.com/lists/oss-security/2026/05/15/9","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2026/05/20/14","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2026/05/20/16","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2026/05/msg00032.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2026/05/msg00035.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2026:19521","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19540","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19568","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19569","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19664","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19666","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19705","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19711","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:19875","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20051","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20054","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20129","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20130","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20299","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20593","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:21701","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:21702","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:23468","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:23469","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:23470","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:23471","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:24814","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:33486","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-46333","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477802","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn/","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46333.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2026-004"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46333"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46333"},{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2026/05/20/cve-2026-46333-local-root-privilege-escalation-and-credential-disclosure-in-the-linux-kernel-ptrace-path"},{"url":"https://github.com/torvalds/linux/commit/31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a"}],"tags":["nvd","exploit-available","cve.org","csaf","vex","red-hat"],"epss":0.04299,"epssPercentile":0.91087,"exploits":{"github":5,"githubRepos":["https://github.com/0xBlackash/CVE-2026-46333","https://github.com/KaraZajac/CHARON","https://github.com/studiogangster/CVE-2026-46333"],"metasploit":["post/linux/gather/cve_2026_46333_chage"],"checkedAt":"2026-10-27T19:00:56.887Z"},"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-05-21T00:00:00+00:00"},"scores":{"nvd":7.1,"vendor":7.8,"cna":7.1},"ingestedAt":"2026-07-01T09:50:45.815Z","slug":"CVE-2026-46333","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nptrace: slightly saner 'get_dumpable()' logic\n\nThe 'dumpability' of a task is fundamentally about the memory image of\nthe task - the concept comes from whether it can core dump or not - and\nmakes no sense when you don't have an associated mm.\n\nAnd almost all users do in fact use it only for the case where the task\nhas a mm pointer.\n\nBut we have one odd special case: ptrace_may_access() uses 'dumpable' to\ncheck various other things entirely independently of the MM (typically\nexplicitly using flags like PTRACE_MODE_READ_FSCREDS).  Including for\nthreads that no longer have a VM (and maybe never did, like most kernel\nthreads).\n\nIt's not what this flag was designed for, but it is what it is.\n\nThe ptrace code does check that the uid/gid matches, so you do have to\nbe uid-0 to see kernel thread details, but this means that the\ntraditional \"drop capabilities\" model doesn't make any difference for\nthis all.\n\nMake it all make a *bit* more sense by saying that if you don't have a\nMM pointer, we'll use a cached \"last dumpability\" flag if the thread\never had a MM (it will be zero for kernel threads since it is never\nset), and require a proper CAP_SYS_PTRACE capability to override.\n\n## Affected\n\n- `linux_kernel >= 3.16.52, < 3.17`\n- `linux_kernel >= 4.4.40, < 4.5`\n- `linux_kernel >= 4.8.16, < 4.9`\n- `linux_kernel >= 4.9.1, < 5.10.256`\n- `linux_kernel >= 5.11, < 5.15.207`\n- `linux_kernel >= 5.16, < 6.1.173`\n- `linux_kernel >= 6.2, < 6.6.139`\n- `linux_kernel >= 6.7, < 6.12.89`\n- `linux_kernel >= 6.13, < 6.18.31`\n- `linux_kernel >= 6.19, < 7.0.8`\n- `linux_kernel = 7.1`\n- `debian_linux = 11.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.0.8`\n\n## Vendor advisories\n\n- **RHSA-2026:19540** · Red Hat · fixed in: NVIDIA for RHEL 10 · released 2026-05-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:19540)\n- **RHSA-2026:33486** · Red Hat · fixed in: NVIDIA for RHEL 10 · released 2026-06-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:33486)\n- **RHSA-2026:21701** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.20 · released 2026-06-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:21701)\n- **RHSA-2026:21702** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.20 · released 2026-06-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:21702)\n- **RHSA-2026:20299** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0) · released 2026-05-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:20299)\n- **RHSA-2026:19569** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-05-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:19569)\n- **RHSA-2026:19705** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.0), Red Hat Enterprise Linux BaseOS E4S (v.9.0) · released 2026-05-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:19705)\n- **RHSA-2026:20593** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2) · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20593)\n- **RHSA-2026:20054** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat Enterprise Linux BaseOS EUS (v.9.4), Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4), Red Hat Enterprise Linux Real Time EUS (v.9.4) · released 2026-05-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:20054)\n- **RHSA-2026:20129** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6) · released 2026-05-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:20129)\n- **RHSA-2026:19568** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-05-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:19568)\n- **Red Hat VEX** · Important · affected: Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift Container Platform 4 · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46333.json)","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":39.1,"likelihood":0.9,"exploitation":12,"ransomware":0},"changes":[{"seq":5251,"id":"CVE-2026-46333","ts":1788887256802,"field":"exploit_available","old":"false","new":"true"},{"seq":4134,"id":"CVE-2026-46333","ts":1788886373235,"field":"exploit_available","old":"true","new":"false"},{"seq":2907,"id":"CVE-2026-46333","ts":1788883039137,"field":"exploit_available","old":"false","new":"true"},{"seq":1936,"id":"CVE-2026-46333","ts":1788882442157,"field":"exploit_available","old":"true","new":"false"},{"seq":312,"id":"CVE-2026-46333","ts":1788881649331,"field":"exploit_available","old":"false","new":"true"}]}