PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46057 Linux CVE debrief

A logic error in the Linux kernel's Landlock security module causes the LOG_SUBDOMAINS_OFF flag to be lost when a process forks. The hook_cred_transfer() function only copies the Landlock credential blob when a domain is present, but landlock_restrict_self() can set LOG_SUBDOMAINS_OFF without creating a domain (via ruleset_fd=-1). This inconsistency breaks the documented workflow where a parent process mutes subdomain audit logs before forking sandboxed children—the children inherit neither the muting nor the intended audit suppression, causing unexpected log generation. The fix unconditionally copies the Landlock credential blob during credential transfer, ensuring LOG_SUBDOMAINS_OFF persists across fork().

Vendor
Linux
Product
Unknown
CVSS
LOW 3.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

Organizations using Landlock sandboxing with audit log muting, security teams monitoring Linux kernel LSM behavior, and developers implementing privilege separation patterns that rely on LOG_SUBDOMAINS_OFF persistence across process creation

Technical summary

The Landlock Linux Security Module (LSM) contains a logic error in hook_cred_transfer() where the credential blob copy is conditional on domain presence. When landlock_restrict_self() sets LOG_SUBDOMAINS_OFF via the ruleset_fd=-1 path, no domain is created, so the flag is committed but not preserved across fork(). The fix unconditionally copies the Landlock credential blob, ensuring LOG_SUBDOMAINS_OFF inheritance matches documented behavior.

Defensive priority

medium

Recommended defensive actions

  • Review Landlock-enabled applications that use LOG_SUBDOMAINS_OFF muting before fork() to ensure they are running patched kernels
  • Audit unexpected subdomain audit log generation in sandboxed child processes as a potential indicator of this bug
  • Apply kernel updates containing the referenced stable commits when available through distribution channels
  • Verify that processes relying on landlock_restrict_self() with ruleset_fd=-1 for log muting behave correctly after fork() on patched systems

Evidence notes

The vulnerability description and fix are drawn from the CVE record published 2026-05-27. The issue affects Landlock's credential inheritance path specifically when LOG_SUBDOMAINS_OFF is set without an associated domain. Three kernel.org stable commits are referenced as source material. No CVSS score or severity has been assigned by NVD as of the modified date (2026-05-27T14:48:03Z).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46057 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46057

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46057 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46057

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1c513b8a00df13d231021e74ad92babb3fedf64a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/2fcde49092aac55d5beef43fdd3633217672f7d1

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/874c8f83826c95c62c21d9edfe9ef43e5c346724

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.