{"id":"CVE-2026-46333","revision":"864767d6b87a4775b0e3da00311044a6","records":[{"revision":"864767d6b87a4775b0e3da00311044a6","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-46333","aliases":[],"title":"ptrace: slightly saner 'get_dumpable()' logic","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nptrace: slightly saner 'get_dumpable()' logic\n\nThe 'dumpability' of a task is fundamentally about the memory image of\nthe task - the concept comes from whether it can core dump or not - and\nmakes no sense when you don't have an associated mm.\n\nAnd almost all users do in fact use it only for the case where the task\nhas a mm pointer.\n\nBut we have one odd special case: ptrace_may_access() uses 'dumpable' to\ncheck various other things entirely independently of the MM (typically\nexplicitly using flags like PTRACE_MODE_READ_FSCREDS).  Including for\nthreads that no longer have a VM (and maybe never did, like most kernel\nthreads).\n\nIt's not what this flag was designed for, but it is what it is.\n\nThe ptrace code does check that the uid/gid matches, so you do have to\nbe uid-0 to see kernel thread details, but this means that the\ntraditional \"drop capabilities\" model doesn't make any difference for\nthis all.\n\nMake it all make a *bit* more sense by saying that if you don't have a\nMM pointer, we'll use a cached \"last dumpability\" flag if the thread\never had a MM (it will be zero for kernel threads since it is never\nset), and require a proper CAP_SYS_PTRACE capability to override.","state":0,"publishedAt":"2026-05-15T12:58:44.599+00:00","modifiedAt":"2026-10-15T01:21:42.063+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/sched.h\",\n                        \"kernel/exit.c\",\n                        \"kernel/ptrace.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"bfedb589252c01fa505ac9f6f2a3d5d68d707ef4\",\n                            \"lessThan\": \"93d4ba49d18e3d7fb41a9927c2d0cca5e9dfefd6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bfedb589252c01fa505ac9f6f2a3d5d68d707ef4\",\n                            \"lessThan\": \"15b828a46f305ae9f05a7c16914b3ce273474205\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bfedb589252c01fa505ac9f6f2a3d5d68d707ef4\",\n                            \"lessThan\": \"4709234fd1b95136ceb789f639b1e7ea5de1b181\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bfedb589252c01fa505ac9f6f2a3d5d68d707ef4\",\n                            \"lessThan\": \"8f907d345bae8f4b3f004c5abc56bf2dfb851ea7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bfedb589252c01fa505ac9f6f2a3d5d68d707ef4\",\n                            \"lessThan\": \"6e5b51e74a40d377bcd3081dd33fbaa0e1aa7e3d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bfedb589252c01fa505ac9f6f2a3d5d68d707ef4\",\n                            \"lessThan\": \"2a93a4fac7b6051d3be7cd1b015fe7320cd0404d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bfedb589252c01fa505ac9f6f2a3d5d68d707ef4\",\n                            \"lessThan\": \"01363cb3fbd0238ffdeb09f53e9039c9edf8a730\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bfedb589252c01fa505ac9f6f2a3d5d68d707ef4\",\n                            \"lessThan\": \"31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d5b3e840dbf6dd2c0f30b5982b6f5ecd49e46b12\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"03eed7afbc09e061f66b448daf7863174c3dc3f3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e45692fa1aea06676449b63ef3c2b6e1e72b7578\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"694a95fa6dae4991f16cda333d897ea063021fed\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3.16.52\",\n                            \"lessThan\": \"3.17\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.4.40\",\n                            \"lessThan\": \"4.5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.8.16\",\n                            \"lessThan\": \"4.9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.9.1\",\n                            \"lessThan\": \"4.10\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/sched.h\",\n                        \"kernel/exit.c\",\n                        \"kernel/ptrace.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.10\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.256\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.207\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.173\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.139\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.89\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.31\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.8\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":7.1,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/93d4ba49d18e3d7fb41a9927c2d0cca5e9dfefd6","https://git.kernel.org/stable/c/15b828a46f305ae9f05a7c16914b3ce273474205","https://git.kernel.org/stable/c/4709234fd1b95136ceb789f639b1e7ea5de1b181","https://git.kernel.org/stable/c/8f907d345bae8f4b3f004c5abc56bf2dfb851ea7","https://git.kernel.org/stable/c/6e5b51e74a40d377bcd3081dd33fbaa0e1aa7e3d","https://git.kernel.org/stable/c/2a93a4fac7b6051d3be7cd1b015fe7320cd0404d","https://git.kernel.org/stable/c/01363cb3fbd0238ffdeb09f53e9039c9edf8a730","https://git.kernel.org/stable/c/31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-46333","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-46333","identifiers":["CVE-2026-46333"]},"retained":false,"historicalAffected":[]}],"coverage":[]}