PT-2026-44227 · Linux · Linux Kernel

CVE-2026-46104 · Published 2026-05-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description In stacked Linux Security Module (LSM) configurations, the sock has perm() and nlmsg sock has extended perms() functions incorrectly dereference sk->sk security directly. This assumes the SELinux socket blob is located at offset zero. If another LSM allocates socket blob storage before SELinux, these functions may read the wrong blob, leading to invalid Security Identifier (SID) and class values being passed into Access Vector Cache (AVC) checks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2026-46104

OPENSUSE-SU-2026:10954-1

USN-8566-1

USN-8568-1

USN-8569-1

USN-8593-1

USN-8603-1

USN-8618-1

Affected Products

Linux Kernel

References · 1401

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46104.json · Exploit
• https://ubuntu.com/security/CVE-2026-64049 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-64070 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-46024 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-64517 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-63910 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-63841 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-46104 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-64075 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-53025 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-63860 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-45991 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-46137 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-64066 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-46223 · Vendor Advisory