LWN.net (kernel & development security)published May 15, 2026TLP AMBERCorroborated brief
Seven new stable kernels with patches for CVE-2026-46333
Brief status
Corroborated brief
Evidence records
1
Structured pivots
2
Publisher text
Withheld by policy
Forensia structured brief
Built from approved structured facts. Every conclusion below carries evidence references.
Corroborated brief
1
Finding
indicator:23443:description
What happened
NVD describes CVE-2026-46333 as: In the Linux kernel, the following vulnerability has been resolved:
ptrace: slightly saner 'get_dumpable()' logic
The 'dumpability' of a task is fundamentally about the memory image of
the task - the concept comes from whether it can core dump or not - and
makes no sense when you don't have an associated mm.
And almost all users do in fact use it only for the case where the task
has a mm pointer.
But we have one odd special case: ptrace_may_access() uses 'dumpable' to
check various other things entirely independently of the MM (typically
explicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for
threads that no longer have a VM (and maybe never did, like most kernel
threads).
It's not what this flag was designed for, but it is what it is.
The ptrace code does check that the uid/gid matches, so you do have to
be uid-0 to see kernel thread details, but this means that the
traditional "drop capabilities" model doesn't make any difference for
this all.
Make it all make a *bit* more sense by saying that if you don't have a
MM pointer, we'll use a cached "last dumpability" flag if the thread
ever had a MM (it will be zero for kernel threads since it is never
set), and require a proper CAP_SYS_PTRACE capability to override.
Scroll this evidence note to continue
2
Impact
indicator:23443:cvsscisa-kev:CVE-2026-46333
Why it matters
NVD assigns CVE-2026-46333 a CVSS base score of 7.1. CISA lists CVE-2026-46333 in the Known Exploited Vulnerabilities catalog.
3
Scope
indicator:23443:products
Affected systems and entities
The structured record identifies affected product references for CVE-2026-46333: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*.
Check whether the affected product and version are present in your environment, then follow the vendor or NVD remediation guidance for CVE-2026-46333.
publisher text · intentionally withheld
The original article remains with its publisher
This source is currently approved for metadata display only. The structured panel above shows only facts that Forensia can lawfully support. Its status will advance automatically when approved evidence becomes available.
Grouping means the records share event anchors. It does not prove that every publisher independently verified the claims.
rights & provenance
PublisherLWN.net (kernel & development security)
Display policymetadata only
Rights reviewpending
Reader materiallegacy
CapturedMay 15, 2026
Integritysha256:0f0b3c77b54d6f0b03…
Coverage state measures available context, not whether every claim is true or independently corroborated. Unknown publication rights fail closed to metadata and the original source link.