--- id: CVE-2026-46333 title: |- In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of a task is fundamentally about the memory image of the task - the concept comes from whether it can c… summary: |- In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of a task is fundamentally about the memory image of the task - the concept comes from whether it can c… severity: high cvss: 7.1 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N' cwe: - CWE-269 vendor: linux product: linux_kernel affected: - 'linux_kernel >= 3.16.52, < 3.17' - 'linux_kernel >= 4.4.40, < 4.5' - 'linux_kernel >= 4.8.16, < 4.9' - 'linux_kernel >= 4.9.1, < 5.10.256' - 'linux_kernel >= 5.11, < 5.15.207' - 'linux_kernel >= 5.16, < 6.1.173' - 'linux_kernel >= 6.2, < 6.6.139' - 'linux_kernel >= 6.7, < 6.12.89' - 'linux_kernel >= 6.13, < 6.18.31' - 'linux_kernel >= 6.19, < 7.0.8' - linux_kernel = 7.1 - debian_linux = 11.0 patched: - linux_kernel 7.0.8 published: '2026-05-15' updated: '2026-10-15' sourceUpdated: '2026-10-15T02:19:54.770' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-46333' references: - url: 'https://git.kernel.org/stable/c/01363cb3fbd0238ffdeb09f53e9039c9edf8a730' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/15b828a46f305ae9f05a7c16914b3ce273474205' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/2a93a4fac7b6051d3be7cd1b015fe7320cd0404d' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/4709234fd1b95136ceb789f639b1e7ea5de1b181' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/6e5b51e74a40d377bcd3081dd33fbaa0e1aa7e3d' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/8f907d345bae8f4b3f004c5abc56bf2dfb851ea7' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/93d4ba49d18e3d7fb41a9927c2d0cca5e9dfefd6' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'http://www.openwall.com/lists/oss-security/2026/05/15/9' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2026/05/20/14' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2026/05/20/16' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2026/05/msg00032.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2026/05/msg00035.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2026:19521' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:19540' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:19568' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:19569' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:19664' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:19666' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:19705' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:19711' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:19875' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:20051' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:20054' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:20129' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:20130' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:20299' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:20593' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:21701' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:21702' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:23468' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:23469' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:23470' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:23471' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:24814' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:33486' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-46333' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2477802' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://cert-portal.siemens.com/productcert/html/ssa-019113.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-457936.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn/' label: 134c704f-9b21-4f2e-91b3-4a467353bcc0 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46333.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/vulnerabilities/RHSB-2026-004' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-46333' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-46333' - url: >- https://blog.qualys.com/vulnerabilities-threat-research/2026/05/20/cve-2026-46333-local-root-privilege-escalation-and-credential-disclosure-in-the-linux-kernel-ptrace-path - url: >- https://github.com/torvalds/linux/commit/31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a tags: - nvd - exploit-available - cve.org - csaf - vex - red-hat epss: 0.04299 epssPercentile: 0.91087 exploits: github: 5 githubRepos: - 'https://github.com/0xBlackash/CVE-2026-46333' - 'https://github.com/KaraZajac/CHARON' - 'https://github.com/studiogangster/CVE-2026-46333' metasploit: - post/linux/gather/cve_2026_46333_chage checkedAt: '2026-10-27T19:00:56.887Z' exploitAvailable: true ssvc: exploitation: poc automatable: 'no' technicalImpact: total timestamp: '2026-05-21T00:00:00+00:00' scores: nvd: 7.1 vendor: 7.8 cna: 7.1 ingestedAt: '2026-07-01T09:50:45.815Z' --- ## Overview In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and makes no sense when you don't have an associated mm. And almost all users do in fact use it only for the case where the task has a mm pointer. But we have one odd special case: ptrace_may_access() uses 'dumpable' to check various other things entirely independently of the MM (typically explicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for threads that no longer have a VM (and maybe never did, like most kernel threads). It's not what this flag was designed for, but it is what it is. The ptrace code does check that the uid/gid matches, so you do have to be uid-0 to see kernel thread details, but this means that the traditional "drop capabilities" model doesn't make any difference for this all. Make it all make a *bit* more sense by saying that if you don't have a MM pointer, we'll use a cached "last dumpability" flag if the thread ever had a MM (it will be zero for kernel threads since it is never set), and require a proper CAP_SYS_PTRACE capability to override. ## Affected - `linux_kernel >= 3.16.52, < 3.17` - `linux_kernel >= 4.4.40, < 4.5` - `linux_kernel >= 4.8.16, < 4.9` - `linux_kernel >= 4.9.1, < 5.10.256` - `linux_kernel >= 5.11, < 5.15.207` - `linux_kernel >= 5.16, < 6.1.173` - `linux_kernel >= 6.2, < 6.6.139` - `linux_kernel >= 6.7, < 6.12.89` - `linux_kernel >= 6.13, < 6.18.31` - `linux_kernel >= 6.19, < 7.0.8` - `linux_kernel = 7.1` - `debian_linux = 11.0` ## Remediation Upgrade past the affected range: - `linux_kernel 7.0.8` ## Vendor advisories - **RHSA-2026:19540** · Red Hat · fixed in: NVIDIA for RHEL 10 · released 2026-05-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:19540) - **RHSA-2026:33486** · Red Hat · fixed in: NVIDIA for RHEL 10 · released 2026-06-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:33486) - **RHSA-2026:21701** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.20 · released 2026-06-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:21701) - **RHSA-2026:21702** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.20 · released 2026-06-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:21702) - **RHSA-2026:20299** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0) · released 2026-05-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:20299) - **RHSA-2026:19569** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-05-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:19569) - **RHSA-2026:19705** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.0), Red Hat Enterprise Linux BaseOS E4S (v.9.0) · released 2026-05-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:19705) - **RHSA-2026:20593** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2) · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20593) - **RHSA-2026:20054** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat Enterprise Linux BaseOS EUS (v.9.4), Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4), Red Hat Enterprise Linux Real Time EUS (v.9.4) · released 2026-05-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:20054) - **RHSA-2026:20129** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6) · released 2026-05-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:20129) - **RHSA-2026:19568** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-05-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:19568) - **Red Hat VEX** · Important · affected: Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift Container Platform 4 · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46333.json)