CVE-2026-46063

Description

In the Linux kernel, the following vulnerability has been resolved: x86/shstk: Prevent deadlock during shstk sigreturn During sigreturn the shadow stack signal frame is popped. The kernel does this by reading the shadow stack using normal read accesses. When it can't assume the memory is shadow stack, it takes extra steps to makes sure it is reading actual shadow stack memory and not other normal readable memory. It does this by holding the mmap read lock while doing the access and checking the flags of the VMA. Unfortunately that is not safe. If the read of the shadow stack sigframe hits a page fault, the fault handler will try to recursively grab another mmap read lock. This normally works ok, but if a writer on another CPU is also waiting, the second read lock could fail and cause a deadlock. Fix this by not holding mmap lock during the read access to userspace. Instead use mmap_lock_speculate_...() to watch for changes between dropping mmap lock and the userspace access. Retry if anything grabbed an mmap write lock in between and could have changed the VMA. These mmap_lock_speculate_...() helpers use mm::mm_lock_seq, which is only available when PER_VMA_LOCK is configured. So make X86_USER_SHADOW_STACK depend on it. On x86, PER_VMA_LOCK is a default configuration for SMP kernels. So drop support for the other configs under the assumption that the !SMP shadow stack user base does not exist. Currently there is a check that skips the lookup work when the SSP can be assumed to be on a shadow stack. While reorganizing the function, remove the optimization to make the tricky code flows more common, such that issues like this cannot escape detection for so long.

Overview

State: PUBLISHED
Assigner (CNA): Linux
CVSS severity: high
CVSS score: 7.1 / 10
CVSS vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Effective score: 7.1 / 10 HIGH source: CNA overview
MSRC score: 5.5 / 10 MEDIUM MS rating: Moderate
CWE(s): —
Reserved: 2026-05-13
Published: 2026-05-27 12:57 UTC
Last updated: 2026-05-27 12:57 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46063.json
Linked Threat: CVE-2026-46063 — CVE-2026-46063

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-05-27 14:17:26 UTC
NVD last modified: 2026-06-17 10:53:00 UTC
NVD CVSS v3.1: 5.5 / 10 MEDIUM source: nvd@nist.gov
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability subscore: 1.8 / 10
Impact subscore: 3.6 / 10
EPSS score: 0.0009 (probability of exploitation in next 30 days)
EPSS percentile: 0.73% vs all CVEs — higher = more likely to be exploited, as of 2026-08-01

NVD-assigned CWE(s): CWE-667 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-32445
Assigner: Linux
Published: May 27, 2026, 12:57:27 PM
Updated: Jun 14, 2026, 5:51:37 PM
EUVD base score: 0.0 / 10
EUVD-reported EPSS: 0.0900
Vendors: Linux
Products: Linux (7fad2a432cd35bbf104d2d9d426e74902f22aa95 <3d29db827502067626062f5c74dd502d14ab15bc)

Linux (patch: 7.0.4)

Linux (patch: 6.12.88)

Linux (patch: 6.18.27)

Linux (7fad2a432cd35bbf104d2d9d426e74902f22aa95 <d042d69b417515959e49021fef008c9b04a99bd5)

Linux (7fad2a432cd35bbf104d2d9d426e74902f22aa95 <e2c2b044458cbf22da05264fa707308e8d4f86f9)

Linux (patch: 6.6.140)

Linux (7fad2a432cd35bbf104d2d9d426e74902f22aa95 <4f3374c990fb2adec06d20fd6d780927811c9aa0)

Linux (patch: 7.1)

Linux (patch: 0)

Linux (7fad2a432cd35bbf104d2d9d426e74902f22aa95 <9874b2917b9fbc30956fee209d3c4aa47201c64e)

Linux (6.6)
Aliases: GHSA-5h69-gpmh-v98w

ENISA description: In the Linux kernel, the following vulnerability has been resolved: x86/shstk: Prevent deadlock during shstk sigreturn During sigreturn the shadow stack signal frame is popped. The kernel does this by reading the shadow stack using normal read accesses. When it can't assume the memory is shadow stack, it takes extra steps to makes sure it is reading actual shadow stack memory and not other normal readable memory. It does this by holding the mmap read lock while doing the access and checking the flags of the VMA. Unfortunately that is not safe. If the read of the shadow stack sigframe hits a page fault, the fault handler will try to recursively grab another mmap read lock. This normally works ok, but if a writer on another CPU is also waiting, the second read lock could fail and cause a deadlock. Fix this by not holding mmap lock during the read access to userspace. Instead use mmap_lock_speculate_...() to watch for changes between dropping mmap lock and the userspace access. Retry if anything grabbed an mmap write lock in between and could have changed the VMA. These mmap_lock_speculate_...() helpers use mm::mm_lock_seq, which is only available when PER_VMA_LOCK is configured. So make X86_USER_SHADOW_STACK depend on it. On x86, PER_VMA_LOCK is a default configuration for SMP kernels. So drop support for the other configs under the assumption that the !SMP shadow stack user base does not exist. Currently there is a check that skips the lookup work when the SSP can be assumed to be on a shadow stack. While reorganizing the function, remove the optimization to make the tricky code flows more common, such that issues like this cannot escape detection for so long.

EUVD references (5)

Microsoft Security Response Center MSRC

Microsoft's vendor-authoritative record from the Security Update Guide — its own CVSS score, impact, severity rating, exploit assessment, and KB-article fixes. Refreshed 2026-08-12 01:09 UTC (source: CVRF).

MS severity: Moderate
MS CVSS base score: 5.5 / 10 (temporal 5.5)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release: 2026-May

Microsoft remediations / KB articles (2)

CBL-Mariner Releases — Vendor Fix / Security Update (fixed build 6.6.141.1-1)
https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade — None Available / CBL-Mariner Releases

Affected products (2)

Vendor	Product	Versions	Platforms
Linux	Linux	`7fad2a432cd35bbf104d2d9d426e74902f22aa95` (affected), `7fad2a432cd35bbf104d2d9d426e74902f22aa95` (affected), `7fad2a432cd35bbf104d2d9d426e74902f22aa95` (affected), `7fad2a432cd35bbf104d2d9d426e74902f22aa95` (affected), `7fad2a432cd35bbf104d2d9d426e74902f22aa95` (affected)	—
Linux	Linux	`6.6` (affected), `0` (unaffected), `6.6.140` (unaffected), `6.12.88` (unaffected), `6.18.27` (unaffected), `7.0.4` (unaffected), `7.1-rc1` (unaffected)	—

Affected products — CPE 2.3 (1) NVD

NVD's normalized CPE 2.3 matchers, used by vendor tools (vulnerability scanners, asset managers) for automated detection. Compare with the CNA's free-text "Affected products" section above.

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Vendor references (5)

References embedded in the original CVE record by the assigning CNA.

Web references (10)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

MSRC update guide: CVE-2026-46063 msrc
None Available msrc
https://git.kernel.org/stable/c/9874b2917b9fbc30956fee209d3c4aa47201c64e tenable:git.kernel.org
https://git.kernel.org/stable/c/d042d69b417515959e49021fef008c9b04a99bd5 tenable:git.kernel.org
https://git.kernel.org/stable/c/e2c2b044458cbf22da05264fa707308e8d4f86f9 tenable:git.kernel.org
https://nvd.nist.gov/vuln/detail/CVE-2026-46063 tenable:nvd.nist.gov
https://www.cve.org/CVERecord?id=CVE-2026-46063 tenable:www.cve.org
https://git.kernel.org/stable/c/3d29db827502067626062f5c74dd502d14ab15bc tenable:git.kernel.org
https://www.first.org/epss/ tenable:www.first.org
https://git.kernel.org/stable/c/4f3374c990fb2adec06d20fd6d780927811c9aa0 tenable:git.kernel.org

NVD-tagged references (5)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://git.kernel.org/stable/c/3d29db827502067626062f5c74dd502d14ab15bc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/4f3374c990fb2adec06d20fd6d780927811c9aa0 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/9874b2917b9fbc30956fee209d3c4aa47201c64e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/d042d69b417515959e49021fef008c9b04a99bd5 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch
https://git.kernel.org/stable/c/e2c2b044458cbf22da05264fa707308e8d4f86f9 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Patch

Remediations (17)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

RHSB-2026-004 Process Exit Race Condition - Linux Kernel (CVE-2026 ...

web:access.redhat.com

Applying the kernel fix , when available, is the only comprehensive remediation . Option 1: Admin-only scope Setting ptrace_scope to 2 restricts ptrace attach to processes with CAP_SYS_PTRACE. This blocks many currently known exploitation paths, but other paths that do not rely on ptrace may exist. This is suitable for most production environments.

2026-06-04 00:12 UTC
Microsoft and Adobe Patch Tuesday, May 2026 Security Update Review

web:blog.qualys.com

May 2026's Patch Tuesday arrives with Microsoft addressing a fresh set of vulnerabilities across its ecosystem, reinforcing the ongoing need for timely patching in an increasingly threat-heavy…

2026-06-04 00:12 UTC
Microsoft Patch Tuesday May 2026 - 120 Vulnerabilities Fixed, Including ...

web:cybersecuritynews.com

Microsoft's May 2026 Patch Tuesday lands with a heavy enterprise focus, fixing 120 vulnerabilities across Windows, Office, Azure, developer tools, and Microsoft 365 apps, including 29 remote code execution (RCE) flaws rated Critical.

2026-06-04 00:12 UTC
CVE-2026-46333: Linux Kernel Local Privilege Escalation Bug - What It ...

web:integsec.com

CVE - 2026 -46333 matters because it transforms any local user account on your Linux servers into a potential root-level compromise. This vulnerability affects organizations across North America that rely on Linux infrastructure for everything from web hosting to database management and cloud services. If your business operates servers running unpatched Linux kernels, you face genuine risk of ...

2026-06-04 00:12 UTC
Security Update Guide - Microsoft

web:portal.msrc.microsoft.com

The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

2026-06-04 00:12 UTC
A guide to vulnerability remediation vs mitigation | @Bugcrowd

web:www.bugcrowd.com

Vulnerability mitigation is typically considered a temporary or interim solution. While mitigation measures can reduce the immediate risk associated with vulnerabilities, they may not provide a permanent fix . Organizations should aim to prioritize and plan for complete vulnerability remediation whenever feasible and allocate resources accordingly.

2026-06-04 00:12 UTC
April 2026 Patch Tuesday: Updates and Analysis | CrowdStrike

web:www.crowdstrike.com

Microsoft's April 2026 Patch Tuesday addresses 164 CVEs , featuring 8 Critical vulnerabilities, one exploited zero-day, and one disclosed zero-day.

2026-06-04 00:12 UTC
Microsoft Patch Tuesday - May 2026 - Lansweeper

web:www.lansweeper.com

Which vulnerabilities, issues, and other things did Microsoft update? Discover what's new using Lansweeper's Patch Tuesday May 2026 summary.

2026-06-04 00:12 UTC
Oracle Critical Security Patch Update Advisory - May 2026

web:www.oracle.com

This Critical Security Patch Update contains 35 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Security Patch Update and other Oracle Software Security Assurance activities is located at May 2026 Critical Security Patch Update: Executive Summary and Analysis.

2026-06-04 00:12 UTC
Patch Tuesday June 2026: Security Updates & CVE Analysis

web:zecurit.com

Get the complete breakdown of Microsoft's June 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

2026-06-04 00:12 UTC
Security Update Guide - Microsoft Security Response Center

web:msrc.microsoft.com

Security Update Guide - Microsoft Security Response Center

2026-06-19 02:28 UTC
SAP Security Patch Day - February 2026

web:support.sap.com

SAP security Patch Day Bulletin This post shares the information on security notes that remediate vulnerabilities discovered in SAP products. SAP strongly recommends that the customer visits the Support Portal and applies patches on priority to protect their SAP landscape. On 10th of February 2026 , SAP security patch day saw the release of 26 new security notes. Further, there was 1 update to ...

2026-06-19 02:28 UTC
Microsoft is working on a patch for 'YellowKey ... - Computerworld

web:www.computerworld.com

Microsoft says it is considering a patch for a zero-day vulnerability, dubbed YellowKey, that allows attackers with access to a Windows device to bypass Bitlocker encryption protection and read ...

2026-06-19 02:28 UTC
May 2026 Patch Tuesday: Updates and Analysis | CrowdStrike

web:www.crowdstrike.com

Microsoft has released security updates for 130 vulnerabilities, including 30 critical, in its May 2026 Patch Tuesday rollout.

2026-06-19 02:28 UTC
Microsoft working on a fix for RoguePlanet, a flaw that grants full PC ...

web:www.malwarebytes.com

Microsoft says it's working on a fix for an unpatched Defender vulnerability that can give attackers the highest level of access on Windows.

2026-06-19 02:28 UTC
Oracle Critical Patch Update Advisory - April 2026

web:www.oracle.com

This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

2026-06-19 02:28 UTC
Patch Tuesday - June 2026 - Rapid7

web:www.rapid7.com

Microsoft is publishing 200 vulnerabilities on June 2026 Patch Tuesday, including an HTTP/2 denial of service vulnerability and an elevation of privilege vulnerability in PowerToys.

2026-06-19 02:28 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-46063.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/Kconfig",
            "arch/x86/kernel/shstk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e2c2b044458cbf22da05264fa707308e8d4f86f9",
              "status": "affected",
              "version": "7fad2a432cd35bbf104d2d9d426e74902f22aa95",
              "versionType": "git"
            },
            {
              "lessThan": "d042d69b417515959e49021fef008c9b04a99bd5",
              "status": "affected",
              "version": "7fad2a432cd35bbf104d2d9d426e74902f22aa95",
              "versionType": "git"
            },
            {
              "lessThan": "4f3374c990fb2adec06d20fd6d780927811c9aa0",
              "status": "affected",
              "version": "7fad2a432cd35bbf104d2d9d426e74902f22aa95",
              "versionType": "git"
            },
            {
              "lessThan": "3d29db827502067626062f5c74dd502d14ab15bc",
              "status": "affected",
              "version": "7fad2a432cd35bbf104d2d9d426e74902f22aa95",
              "versionType": "git"
            },
            {
              "lessThan": "9874b2917b9fbc30956fee209d3c4aa47201c64e",
              "status": "affected",
              "version": "7fad2a432cd35bbf104d2d9d426e74902f22aa95",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/Kconfig",
            "arch/x86/kernel/shstk.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1-rc1",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/shstk: Prevent deadlock during shstk sigreturn\n\nDuring sigreturn the shadow stack signal frame is popped. The kernel does\nthis by reading the shadow stack using normal read accesses. When it can't\nassume the memory is shadow stack, it takes extra steps to makes sure it is\nreading actual shadow stack memory and not other normal readable memory. It\ndoes this by holding the mmap read lock while doing the access and checking\nthe flags of the VMA.\n\nUnfortunately that is not safe. If the read of the shadow stack sigframe\nhits a page fault, the fault handler will try to recursively grab another\nmmap read lock. This normally works ok, but if a writer on another CPU is\nalso waiting, the second read lock could fail and cause a deadlock.\n\nFix this by not holding mmap lock during the read access to userspace.\n\nInstead use mmap_lock_speculate_...() to watch for changes between dropping\nmmap lock and the userspace access. Retry if anything grabbed an mmap write\nlock in between and could have changed the VMA.\n\nThese mmap_lock_speculate_...() helpers use mm::mm_lock_seq, which is only\navailable when PER_VMA_LOCK is configured. So make X86_USER_SHADOW_STACK\ndepend on it. On x86, PER_VMA_LOCK is a default configuration for SMP\nkernels. So drop support for the other configs under the assumption that\nthe !SMP shadow stack user base does not exist.\n\nCurrently there is a check that skips the lookup work when the SSP can be\nassumed to be on a shadow stack. While reorganizing the function, remove\nthe optimization to make the tricky code flows more common, such that\nissues like this cannot escape detection for so long."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T12:57:27.336Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e2c2b044458cbf22da05264fa707308e8d4f86f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/d042d69b417515959e49021fef008c9b04a99bd5"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f3374c990fb2adec06d20fd6d780927811c9aa0"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d29db827502067626062f5c74dd502d14ab15bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/9874b2917b9fbc30956fee209d3c4aa47201c64e"
        }
      ],
      "title": "x86/shstk: Prevent deadlock during shstk sigreturn",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46063",
    "datePublished": "2026-05-27T12:57:27.336Z",
    "dateReserved": "2026-05-13T15:03:33.095Z",
    "dateUpdated": "2026-05-27T12:57:27.336Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}