PT-2026-43921 · Linux · Linux Kernel

Published 2026-05-27 · Updated 2026-06-12 · CVE-2026-46054

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The SELinux security model for overlayfs allows access if the current task can access the top-level user file and the mounter's credentials are sufficient for the lower-level backing file. However, access controls were not properly enforced for mmap() and mprotect() operations on overlayfs filesystems. The issue is addressed by using the security mmap backing file() LSM hook for mmap() operations and utilizing the backing file API and a new LSM blob to enforce mprotect() access controls.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

ALSA-2026:25191

CVE-2026-46054

OPENSUSE-SU-2026:10954-1

Affected Products

Linux Kernel

References · 304

• https://git.kernel.org/stable/c/82544d36b1729153c8aeb179e84750f0c085d3b1 · Patch
• https://cve.org/CVERecord?id=CVE-2026-46054 · Security Note
• https://git.kernel.org/stable/c/cd0e707a927a70cdfd8bc5a512a9719a87f5ed51 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2026:10954-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-46054 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-46054 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-46054 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46054 · Security Note
• https://ubuntu.com/security/CVE-2026-46054 · Vendor Advisory
• https://errata.almalinux.org/10/ALSA-2026-25191.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-46054 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:25191 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-45841 · Note
• https://suse.com/security/cve/CVE-2026-46164 · Note
• https://suse.com/security/cve/CVE-2026-46037 · Note