CVE-2026-46333

Description

In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and makes no sense when you don't have an associated mm. And almost all users do in fact use it only for the case where the task has a mm pointer. But we have one odd special case: ptrace_may_access() uses 'dumpable' to check various other things entirely independently of the MM (typically explicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for threads that no longer have a VM (and maybe never did, like most kernel threads). It's not what this flag was designed for, but it is what it is. The ptrace code does check that the uid/gid matches, so you do have to be uid-0 to see kernel thread details, but this means that the traditional "drop capabilities" model doesn't make any difference for this all. Make it all make a *bit* more sense by saying that if you don't have a MM pointer, we'll use a cached "last dumpability" flag if the thread ever had a MM (it will be zero for kernel threads since it is never set), and require a proper CAP_SYS_PTRACE capability to override.

Overview

State: PUBLISHED
Assigner (CNA): Linux
CVSS severity: high
CVSS score: 7.1 / 10
CVSS vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Effective score: 7.1 / 10 HIGH source: CNA overview
MSRC score: 5.5 / 10 MEDIUM MS rating: Moderate
CWE(s): —
Reserved: 2026-05-13
Published: 2026-05-15 14:58 UTC
Last updated: 2026-05-17 17:21 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/46xxx/CVE-2026-46333.json
Linked Threat: CVE-2026-46333 — CVE-2026-46333

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-05-15 14:16:35 UTC
NVD last modified: 2026-05-21 14:16:48 UTC
NVD CVSS v3.1: 7.1 / 10 HIGH source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
NVD CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Exploitability subscore: 1.8 / 10
Impact subscore: 5.2 / 10
EPSS score: 0.0001 (probability of exploitation in next 30 days)
EPSS percentile: 0.87% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

NVD-assigned CWE(s): CWE-269 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-30540
Assigner: Linux
Published: May 15, 2026, 12:58:44 PM
Updated: May 23, 2026, 4:07:12 PM
EUVD base score (CVSS 3.1): 7.1 / 10
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EUVD-reported EPSS: 0.0100
Vendors: Linux
Products: Linux (4.9.1 <4.10)

Linux (e45692fa1aea06676449b63ef3c2b6e1e72b7578)

Linux (3.16.52 <3.17)

Linux (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <8f907d345bae8f4b3f004c5abc56bf2dfb851ea7)

Linux (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <93d4ba49d18e3d7fb41a9927c2d0cca5e9dfefd6)

Linux (bfedb589252c01fa505ac9f6f2a3d5d68d707ef4 <01363cb3fbd0238ffdeb09f53e9039c9edf8a730)

Linux (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <15b828a46f305ae9f05a7c16914b3ce273474205)

Linux (4.8.16 <4.9)

Linux (bfedb589252c01fa505ac9f6f2a3d5d68d707ef4 <6e5b51e74a40d377bcd3081dd33fbaa0e1aa7e3d)

Linux (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <2a93a4fac7b6051d3be7cd1b015fe7320cd0404d)

Linux (4.4.40 <4.5)

Linux (patch: 6.6.139)

Linux (4.10)

Linux (bfedb589252c01fa505ac9f6f2a3d5d68d707ef4 <15b828a46f305ae9f05a7c16914b3ce273474205)

Linux (bfedb589252c01fa505ac9f6f2a3d5d68d707ef4 <93d4ba49d18e3d7fb41a9927c2d0cca5e9dfefd6)

Linux (patch: 7.0.8)

Linux (694a95fa6dae4991f16cda333d897ea063021fed)

Linux (patch: 6.18.31)

Linux (bfedb589252c01fa505ac9f6f2a3d5d68d707ef4 <31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a)

Linux (patch: 5.15.207)

Linux (patch: 5.10.256)

Linux (patch: 6.1.173)

Linux (patch: 6.12.89)

Linux (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <4709234fd1b95136ceb789f639b1e7ea5de1b181)

Linux (d5b3e840dbf6dd2c0f30b5982b6f5ecd49e46b12)

Linux (bfedb589252c01fa505ac9f6f2a3d5d68d707ef4 <4709234fd1b95136ceb789f639b1e7ea5de1b181)

Linux (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <01363cb3fbd0238ffdeb09f53e9039c9edf8a730)

Linux (bfedb589252c01fa505ac9f6f2a3d5d68d707ef4 <8f907d345bae8f4b3f004c5abc56bf2dfb851ea7)

Linux (03eed7afbc09e061f66b448daf7863174c3dc3f3)

Linux (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <6e5b51e74a40d377bcd3081dd33fbaa0e1aa7e3d)

Linux (bfedb589252c01fa505ac9f6f2a3d5d68d707ef4 <2a93a4fac7b6051d3be7cd1b015fe7320cd0404d)

Linux (patch: 7.1-rc4)

Linux (patch: 0)
Aliases: GHSA-pm8f-4p6p-6x53

ENISA description: In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and makes no sense when you don't have an associated mm. And almost all users do in fact use it only for the case where the task has a mm pointer. But we have one odd special case: ptrace_may_access() uses 'dumpable' to check various other things entirely independently of the MM (typically explicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for threads that no longer have a VM (and maybe never did, like most kernel threads). It's not what this flag was designed for, but it is what it is. The ptrace code does check that the uid/gid matches, so you do have to be uid-0 to see kernel thread details, but this means that the traditional "drop capabilities" model doesn't make any difference for this all. Make it all make a *bit* more sense by saying that if you don't have a MM pointer, we'll use a cached "last dumpability" flag if the thread ever had a MM (it will be zero for kernel threads since it is never set), and require a proper CAP_SYS_PTRACE capability to override.

EUVD references (8)

Microsoft Security Response Center MSRC

Microsoft's vendor-authoritative record from the Security Update Guide — its own CVSS score, impact, severity rating, exploit assessment, and KB-article fixes. Refreshed 2026-07-28 03:00 UTC (source: CVRF).

MS severity: Moderate
MS CVSS base score: 5.5 / 10 (temporal 5.5)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release: 2026-May

Microsoft remediations / KB articles (2)

CBL-Mariner Releases — Vendor Fix / Security Update (fixed build 6.12.89.1-1)
https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade — None Available / CBL-Mariner Releases

Affected products (2)

Vendor	Product	Versions	Platforms
Linux	Linux	`bfedb589252c01fa505ac9f6f2a3d5d68d707ef4` (affected), `bfedb589252c01fa505ac9f6f2a3d5d68d707ef4` (affected), `bfedb589252c01fa505ac9f6f2a3d5d68d707ef4` (affected), `bfedb589252c01fa505ac9f6f2a3d5d68d707ef4` (affected), `bfedb589252c01fa505ac9f6f2a3d5d68d707ef4` (affected), `bfedb589252c01fa505ac9f6f2a3d5d68d707ef4` (affected), `bfedb589252c01fa505ac9f6f2a3d5d68d707ef4` (affected), `d5b3e840dbf6dd2c0f30b5982b6f5ecd49e46b12` (affected), `03eed7afbc09e061f66b448daf7863174c3dc3f3` (affected), `e45692fa1aea06676449b63ef3c2b6e1e72b7578` (affected), `694a95fa6dae4991f16cda333d897ea063021fed` (affected)	—
Linux	Linux	`4.10` (affected), `0` (unaffected), `5.10.256` (unaffected), `5.15.207` (unaffected), `6.1.173` (unaffected), `6.6.139` (unaffected), `6.12.89` (unaffected), `6.18.31` (unaffected), `7.0.8` (unaffected)	—

Vendor references (7)

References embedded in the original CVE record by the assigning CNA.

MITRE references (7) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

Web references (19)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

MSRC update guide: CVE-2026-46333 msrc
None Available msrc
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30540 rapid7:euvd.enisa.europa.eu
https://attackerkb.com/topics/CVE-2026-46333 rapid7:attackerkb.com
http://cwe.mitre.org/data/definitions/269.html rapid7:cwe.mitre.org
http://www.openwall.com/lists/oss-security/2026/05/20/16 tenable:www.openwall.com
https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn/ tenable:github.com
https://git.kernel.org/stable/c/31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a tenable:git.kernel.org
https://thehackernews.com/2026/05/9-year-old-linux-kernel-flaw-enables.html tenable:thehackernews.com
https://thehackernews.com/2026/05/dirtydecrypt-poc-released-for-linux.html tenable:thehackernews.com
https://www.cve.org/CVERecord?id=CVE-2026-46333 tenable:www.cve.org
https://www.first.org/epss/ tenable:www.first.org
https://www.infosecurity-magazine.com/news/linux-kernel-ptrace-flaw-ssh-keys/ tenable:www.infosecurity-magazine.com
http://www.openwall.com/lists/oss-security/2026/05/15/9 tenable:www.openwall.com
http://www.openwall.com/lists/oss-security/2026/05/20/14 tenable:www.openwall.com
https://lists.debian.org/debian-lts-announce/2026/05/msg00032.html tenable:lists.debian.org
https://lists.debian.org/debian-lts-announce/2026/05/msg00035.html tenable:lists.debian.org
https://nvd.nist.gov/vuln/detail/CVE-2026-46333 tenable:nvd.nist.gov
https://securityaffairs.com/192436/uncategorized/dirtydecrypt-poc-released-for-yet-another-linux-flaw.html tenable:securityaffairs.com

NVD-tagged references (14)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

http://www.openwall.com/lists/oss-security/2026/05/15/9 af854a3a-2127-422b-91ae-364da2661108
http://www.openwall.com/lists/oss-security/2026/05/20/14 af854a3a-2127-422b-91ae-364da2661108
http://www.openwall.com/lists/oss-security/2026/05/20/16 af854a3a-2127-422b-91ae-364da2661108
https://git.kernel.org/stable/c/01363cb3fbd0238ffdeb09f53e9039c9edf8a730 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/15b828a46f305ae9f05a7c16914b3ce273474205 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/2a93a4fac7b6051d3be7cd1b015fe7320cd0404d 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/4709234fd1b95136ceb789f639b1e7ea5de1b181 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/6e5b51e74a40d377bcd3081dd33fbaa0e1aa7e3d 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/8f907d345bae8f4b3f004c5abc56bf2dfb851ea7 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/93d4ba49d18e3d7fb41a9927c2d0cca5e9dfefd6 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn/ 134c704f-9b21-4f2e-91b3-4a467353bcc0
https://lists.debian.org/debian-lts-announce/2026/05/msg00032.html af854a3a-2127-422b-91ae-364da2661108
https://lists.debian.org/debian-lts-announce/2026/05/msg00035.html af854a3a-2127-422b-91ae-364da2661108

Remediations (16)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Linux Kernel ptrace Exit-race Vulnerability / ssh-keysign-pwn (CVE-2026 ...

web:blog.cloudlinux.com

Linux kernel ptrace exit-race ( CVE-2026-46333 ) leaks SSH host keys and /etc/shadow. CloudLinux 8 LTS, 9, and 10 affected. Mitigation and status.

2026-05-23 20:51 UTC
CVE-2026-46333: Local Root Privilege Escalation and Credential ...

web:blog.qualys.com

Over the following three days the kernel security team developed and reviewed the fix , CVE-2026-46333 was assigned, and the patch was committed publicly on 2026 -05-14. We then engaged the linux-distros mailing list, the standard pre-disclosure channel for downstream coordination.

2026-05-23 20:51 UTC
Critical Linux Kernel Vulnerability CVE-2026-46333 Exposes 9

web:cybelangel.com

The pattern behind the patch CVE-2026-46333 is the fourth Linux kernel privilege-escalation issue disclosed in three weeks, following Copy Fail (April 29), Dirty Frag (May 7), and Fragnesia (May 13). Each one triggered the same cycle: disclosure, patch scramble, return to business as usual.

2026-05-23 20:51 UTC
CVE-2026-46333: Linux Kernel Flaw Grants Root via ssh-keysign

web:dailysecurityreview.com

Qualys disclosed CVE-2026-46333 , a nine-year-old Linux privilege escalation flaw that gives local users a reliable path to root on Debian, Fedora, and Ubuntu.

2026-05-23 20:51 UTC
AI Discovers CVE-2026-46333 Linux Kernel Vulnerability

web:linuxstans.com

AI-powered code analysis uncovers fourth critical Linux kernel flaw in May 2026 . CVE-2026-46333 targets ptrace. Get mitigation steps and patch info here.

2026-05-23 20:51 UTC
Seven new stable kernels with patches for CVE-2026-46333

web:lwn.net

These kernels contain a patch for CVE-2026-46333 a vulnerability reported by the Qualys Security Advisory team, though Jann Horn proposed a patch in 2020. The vulnerability has a proof-of-concept exploit published already. Some of the kernels have additional patches for other bugs; as always, users are advised to upgrade.

2026-05-23 20:51 UTC
Security Update Guide - Microsoft Security Response Center

web:msrc.microsoft.com

Security Update Guide - Microsoft Security Response Center

2026-05-23 20:51 UTC
CVE-2026-46333 (ssh-keysign-pwn) Linux kernel vulnerability ... - Ubuntu

web:ubuntu.com

The ID CVE-2026-46333 was assigned, but the vulnerability is also referred to as "ssh-keysign-pwn", based on the proof-of-concept exploit. The vulnerability is a race condition that can result in the disclosure of sensitive files to unprivileged local users.

2026-05-23 20:51 UTC
Nine-Year Linux Kernel Flaw (CVE-2026-46333) Enables Root Exploitation ...

web:undercodenews.com

Introduction A severe security vulnerability has been uncovered in the Linux ecosystem, revealing how a long-standing logic flaw inside the kernel could allow local attackers to escalate privileges, steal sensitive credentials, and compromise entire systems. The issue, tracked as CVE-2026-46333 , affects nearly a decade of kernel releases and has significant implications for enterprise ...

2026-05-23 20:51 UTC
CVE-2026-46333 (ssh-keysign-pwn): The Fourth Linux Kernel Vulnerability ...

web:www.gotekky.com

On May 14, 2026 , the Qualys Threat Research Unit publicly disclosed CVE-2026-46333 , a Linux kernel logic flaw that lets any unprivileged local user read root-owned files including SSH host private keys and the contents of /etc/shadow. A working public proof-of-concept named ssh-keysign-pwn is available on GitHub. Linus Torvalds committed the upstream fix (commit 31e62c2ebbfd) the same day the ...

2026-05-23 20:51 UTC
CVE-2026-46333 - Vulnerability Details - OpenCVE

web:app.opencve.io

Remediation No vendor fix or workaround currently provided. OpenCVE Recommended Actions Update the Linux kernel to a version that includes the commit correcting get_dumpable logic. Configure the kernel's yama.ptrace_scope sysctl (kernel.yama.ptrace_scope) to at least 1, limiting ptrace usage to trusted processes.

2026-05-26 02:58 UTC
Qualys publishes advisory for Linux kernel flaw CVE-2026-46333

web:cyberriskleaders.com

Qualys Threat Research Unit (TRU) has published an advisory for CVE-2026-46333 , a local logic flaw in the Linux kernel's __ptrace_may_access() function that it says could allow an unprivileged local user to disclose sensitive files and execute arbitrary commands as root on default installations of several major distributions.

2026-05-26 02:58 UTC
ssh-keysign-pwn (CVE-2026-46333): Linux Local Information Disclosure ...

web:knightli.com

A practical review of ssh-keysign-pwn ( CVE-2026-46333 ): impact, root cause, patch status, temporary mitigations , and operations guidance for a Linux kernel ptrace access-check race that may expose SSH host private keys and /etc/shadow.

2026-05-26 02:58 UTC
CVE-2026-46333 | Ubuntu

web:ubuntu.com

Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things.

2026-05-26 02:58 UTC
Mitigate CVE-2026-46333 with kernel patches and ptrace ... - LinkedIn

web:www.linkedin.com

Reminder: CVE-2026-46333 HOW TO apply the latest kernel patches that fix CVE-2026-46333 . Apply the patched upstream kernels to completely resolve the CVE-2026-46333 privilege-escalation flaw. If ...

2026-05-26 02:58 UTC
CVE-2026-46333 - High Vulnerability - TheHackerWire

web:www.thehackerwire.com

To protect against CVE-2026-46333 , you should: (1) Apply the latest security patches from the vendor, (2) Check official security advisories for specific remediation steps, (3) Update affected software to the latest version, and (4) Monitor your systems for any signs of exploitation.

2026-05-26 02:58 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-46333.json.

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-05-16T12:20:56.774Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/05/15/9"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00032.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/sched.h",
            "kernel/exit.c",
            "kernel/ptrace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "93d4ba49d18e3d7fb41a9927c2d0cca5e9dfefd6",
              "status": "affected",
              "version": "bfedb589252c01fa505ac9f6f2a3d5d68d707ef4",
              "versionType": "git"
            },
            {
              "lessThan": "15b828a46f305ae9f05a7c16914b3ce273474205",
              "status": "affected",
              "version": "bfedb589252c01fa505ac9f6f2a3d5d68d707ef4",
              "versionType": "git"
            },
            {
              "lessThan": "4709234fd1b95136ceb789f639b1e7ea5de1b181",
              "status": "affected",
              "version": "bfedb589252c01fa505ac9f6f2a3d5d68d707ef4",
              "versionType": "git"
            },
            {
              "lessThan": "8f907d345bae8f4b3f004c5abc56bf2dfb851ea7",
              "status": "affected",
              "version": "bfedb589252c01fa505ac9f6f2a3d5d68d707ef4",
              "versionType": "git"
            },
            {
              "lessThan": "6e5b51e74a40d377bcd3081dd33fbaa0e1aa7e3d",
              "status": "affected",
              "version": "bfedb589252c01fa505ac9f6f2a3d5d68d707ef4",
              "versionType": "git"
            },
            {
              "lessThan": "2a93a4fac7b6051d3be7cd1b015fe7320cd0404d",
              "status": "affected",
              "version": "bfedb589252c01fa505ac9f6f2a3d5d68d707ef4",
              "versionType": "git"
            },
            {
              "lessThan": "01363cb3fbd0238ffdeb09f53e9039c9edf8a730",
              "status": "affected",
              "version": "bfedb589252c01fa505ac9f6f2a3d5d68d707ef4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d5b3e840dbf6dd2c0f30b5982b6f5ecd49e46b12",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "03eed7afbc09e061f66b448daf7863174c3dc3f3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e45692fa1aea06676449b63ef3c2b6e1e72b7578",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "694a95fa6dae4991f16cda333d897ea063021fed",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/sched.h",
            "kernel/exit.c",
            "kernel/ptrace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.10"
            },
            {
              "lessThan": "4.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.256",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.207",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.173",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.139",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.89",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.256",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.207",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.173",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.139",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.89",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.31",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.8",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.52",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.40",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.8.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nptrace: slightly saner 'get_dumpable()' logic\n\nThe 'dumpability' of a task is fundamentally about the memory image of\nthe task - the concept comes from whether it can core dump or not - and\nmakes no sense when you don't have an associated mm.\n\nAnd almost all users do in fact use it only for the case where the task\nhas a mm pointer.\n\nBut we have one odd special case: ptrace_may_access() uses 'dumpable' to\ncheck various other things entirely independently of the MM (typically\nexplicitly using flags like PTRACE_MODE_READ_FSCREDS).  Including for\nthreads that no longer have a VM (and maybe never did, like most kernel\nthreads).\n\nIt's not what this flag was designed for, but it is what it is.\n\nThe ptrace code does check that the uid/gid matches, so you do have to\nbe uid-0 to see kernel thread details, but this means that the\ntraditional \"drop capabilities\" model doesn't make any difference for\nthis all.\n\nMake it all make a *bit* more sense by saying that if you don't have a\nMM pointer, we'll use a cached \"last dumpability\" flag if the thread\never had a MM (it will be zero for kernel threads since it is never\nset), and require a proper CAP_SYS_PTRACE capability to override."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-17T15:21:40.832Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/93d4ba49d18e3d7fb41a9927c2d0cca5e9dfefd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/15b828a46f305ae9f05a7c16914b3ce273474205"
        },
        {
          "url": "https://git.kernel.org/stable/c/4709234fd1b95136ceb789f639b1e7ea5de1b181"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f907d345bae8f4b3f004c5abc56bf2dfb851ea7"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e5b51e74a40d377bcd3081dd33fbaa0e1aa7e3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a93a4fac7b6051d3be7cd1b015fe7320cd0404d"
        },
        {
          "url": "https://git.kernel.org/stable/c/01363cb3fbd0238ffdeb09f53e9039c9edf8a730"
        }
      ],
      "title": "ptrace: slightly saner 'get_dumpable()' logic",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46333",
    "datePublished": "2026-05-15T12:58:44.599Z",
    "dateReserved": "2026-05-13T15:03:33.113Z",
    "dateUpdated": "2026-05-17T15:21:40.832Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}