PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46104 Linux CVE debrief

A vulnerability in the Linux kernel's SELinux implementation could cause incorrect security decisions in stacked LSM configurations. The `sock_has_perm()` and `nlmsg_sock_has_extended_perms()` functions directly dereferenced `sk->sk_security`, assuming SELinux's socket blob resides at offset zero. When another LSM allocates socket blob storage first, these helpers read the wrong blob, potentially feeding invalid security identifiers and class values into AVC checks. The fix replaces direct `sk->sk_security` access with the `selinux_sock()` accessor, which correctly retrieves SELinux's blob regardless of stacking order.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-25
Advisory published
2026-05-28
Advisory updated
2026-06-25

Who should care

Organizations running Linux with SELinux enabled alongside other LSMs (stacked configurations), kernel maintainers, distribution security teams, and systems requiring strict mandatory access control enforcement.

Technical summary

The vulnerability exists in SELinux's socket permission checking code. Two helper functions—`sock_has_perm()` and `nlmsg_sock_has_extended_perms()`—directly accessed `sk->sk_security` to retrieve SELinux security state. In Linux Security Module (LSM) stacking configurations, socket blobs are composite structures where multiple LSMs may allocate storage. Direct offset-zero access fails when another LSM allocates first, causing SELinux to read another LSM's blob data. This corruption feeds garbage SID (security identifier) and class values into the AVC (access vector cache), potentially resulting in incorrect permission grants or denials. The resolution uses `selinux_sock()`, the proper accessor that calculates SELinux's blob offset dynamically.

Defensive priority

medium

Recommended defensive actions

  • Review kernel SELinux configurations for stacked LSM deployments
  • Apply kernel updates containing commits 032e70aff025d7c519af9ab791cd084380619263, 7eca71f57f194c1638ebb7f4097d6be8fd04c101, or d350fef4bc2467fe1bce15f7a20fe60e01ce41ad
  • Monitor for kernel stable releases incorporating this fix
  • Audit systems using multiple LSMs (e.g., SELinux with AppArmor or Smack) for potential security policy bypasses

Evidence notes

CVE published 2026-05-28T10:16:25.757Z. Kernel commit references provided for stable branches. No CVSS score or severity assigned by NVD at time of disclosure.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46104 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46104

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46104 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46104

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/032e70aff025d7c519af9ab791cd084380619263

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7eca71f57f194c1638ebb7f4097d6be8fd04c101

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d350fef4bc2467fe1bce15f7a20fe60e01ce41ad

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.