Yüksek CVSS 7.1 PoC var

CVE-2026-46333: Linux Kernel: hatalı yetki yönetimi

Yayın: 15 Mayıs 2026 17:16 · Güncelleme: 6 Kasım 2026 10:19

Açıklama (NVD)

In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and makes no sense when you don't have an associated mm. And almost all users do in fact use it only for the case where the task has a mm pointer. But we have one odd special case: ptrace_may_access() uses 'dumpable' to check various other things entirely independently of the MM (typically explicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for threads that no longer have a VM (and maybe never did, like most kernel threads). It's not what this flag was designed for, but it is what it is. The ptrace code does check that the uid/gid matches, so you do have to be uid-0 to see kernel thread details, but this means that the traditional "drop capabilities" model doesn't make any difference for this all. Make it all make a *bit* more sense by saying that if you don't have a MM pointer, we'll use a cached "last dumpability" flag if the thread ever had a MM (it will be zero for kernel threads since it is never set), and require a proper CAP_SYS_PTRACE capability to override.

Özet bilgiler

Ürün: Linux Linux Kernel
CVSS v3.1: 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS: %4,30 (yüzdelik 91)
CWE: CWE-269
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
linux-linux-kernel	3.16.52	—	3.17
linux-linux-kernel	4.4.40	—	4.5
linux-linux-kernel	4.8.16	—	4.9
linux-linux-kernel	4.9.1	—	5.10.256
linux-linux-kernel	5.11	—	5.15.207
linux-linux-kernel	5.16	—	6.1.173
linux-linux-kernel	6.2	—	6.6.139
linux-linux-kernel	6.7	—	6.12.89
linux-linux-kernel	6.13	—	6.18.31
linux-linux-kernel	6.19	—	7.0.8
linux-linux-kernel	7.1	7.1	—
linux-linux-kernel	7.1	7.1	—
linux-linux-kernel	7.1	7.1	—
debian-debian-linux	11.0	11.0	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları