Skip to main content

Linux Kernel CVE-2026-46055

| EUVDEUVD-2026-32437 HIGH
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-mx5h-mw9c-r2fh
Buffer Overflow Linux Ubuntu Qualcomm Lenovo
7.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local shell on Linux 7.0.x host
  2. Delivery
    Craft mount path lacking NUL terminator
  3. Exploit
    Invoke mount() syscall via snap or userns
  4. Execution
    AppArmor aa_dfa_match reads past 8KB buffer
  5. Persist
    Leak adjacent kernel heap bytes or trigger panic
  6. Impact
    Repeat with heap spray for targeted disclosure

Vulnerability Assessment

Exploitation Conditions

Requires local code execution on a host running an affected Linux 7.0-7.0.3 or 7.1-rc1 kernel with AppArmor compiled in and enforcing (default on Ubuntu and SUSE), plus the ability to invoke the mount() syscall - available to root, to processes inside user namespaces with CAP_SYS_ADMIN, or indirectly via snap/snapd tooling such as snap-update-ns. Exploitation depends on the AppArmor policy evaluator reaching aa_bind_mount() / match_mnt_path_str() for the attacker-controlled path, which occurs on any bind-mount-style operation evaluated against a profile. Limiting factors: the vulnerable kernel range is narrow (mainline 7.0.x and a single rc), the bug is local-only (AV:L), the leaked data is whatever happens to live immediately after the 8KB AppArmor scratch buffer in the kmalloc-rnd-06-8k slab cache (non-deterministic), and hosts without AppArmor enabled (e.g., default RHEL/Fedora with SELinux instead) are not affected.
Impact

The CVSS 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) accurately reflects a local-only attack requiring low privileges, with high confidentiality and availability impact but no integrity impact - consistent with an out-of-bounds read that can leak adjacent kernel heap data and crash the kernel via KASAN/panic. EPSS is 0.02% (5th percentile), this CVE is NOT on the CISA KEV list, and no public exploit code has been identified, so practical risk of opportunistic exploitation is very low. The affected version window is extremely narrow (Linux 7.0 through 7.0.3 mainline plus 7.1-rc1), so exposure is largely limited to bleeding-edge or pre-release deployments such as Ubuntu 26.04 with kernel 7.0; long-term stable branches are unaffected. The most realistic risk is reliability/DoS on affected systems rather than targeted attack - but on systems where untrusted local users can invoke mount() (containers, multi-tenant hosts), the information-disclosure potential warrants prompt patching.
Exploit ScenarioDerived

A local low-privileged user (e.g., a user able to invoke snap commands or mount user namespaces) crafts a mount() syscall whose path argument lands in a heap buffer whose contents extend up to the allocation boundary without a NUL terminator, causing aa_dfa_match() to read into adjacent kernel memory. The attacker repeats the operation while spraying the slab to position useful kernel data adjacent to the buffer, then observes side effects (timing, audit messages, or kernel panic) to infer leaked bytes or to crash the host. No public proof-of-concept is known; the original observation was an organic crash during snap-update-ns execution rather than a weaponized exploit.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 30, 2026

Out-of-bounds read in the Linux kernel's AppArmor LSM subsystem (security/apparmor/match.c) allows a local low-privileged user to trigger a KASAN slab-out-of-bounds read via the mount() syscall on kernels 7.0 through 7.0.3 and 7.1-rc1. The flaw stems from a missing string terminator that causes aa_dfa_match() to read past the end of an 8KB kmalloc buffer when processing mount path strings, resulting in potential information disclosure and system instability (denial of service). No public exploit identified at time of analysis, and EPSS probability is negligible at 0.02%.

RemediationAI

Vendor-released patch: upgrade to Linux kernel 7.0.4 or the 7.1-rc1+ series containing the fix commits 828bf7929bedcb79b560b5b4e44f22abee07d31b (mainline) and 4b877ef27adc8ec187b0418629169856e7264e01 (stable), both available at git.kernel.org/stable/c/. Distribution users should apply the corresponding kernel update from their vendor (e.g., Ubuntu kernel updates for 26.04) as soon as it lands and reboot. If patching must be deferred, the most effective compensating control is to disable AppArmor enforcement of mount rules by booting with apparmor=0 on the kernel command line - this eliminates the vulnerable code path entirely but removes all AppArmor confinement (significant security trade-off, not recommended for production). A less invasive workaround is to restrict use of the mount() syscall by unprivileged users via seccomp filters or by avoiding snap/container workloads that perform frequent bind mounts on the affected kernel, which reduces the attack surface without disabling LSM protection.

Affected VersionsENISA

Linux patch: 0
Linux patch: 7.0.4
Linux 93d4dbdc8da0b8a3ba86f4a08868084f8da872e1 <828bf7929bedcb79b560b5b4e44f22abee07d31b
Linux 7.0
Linux patch: 7.1-rc1
Linux 93d4dbdc8da0b8a3ba86f4a08868084f8da872e1 <4b877ef27adc8ec187b0418629169856e7264e01

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

AppArmor is a Linux Security Module (LSM) that enforces mandatory access control policies, including mount-path restrictions evaluated via deterministic finite automaton (DFA) matching in security/apparmor/match.c. The bug is a classic missing NUL-termination defect (CWE-170 / CWE-125 class) where aa_get_buffer() allocates an 8192-byte buffer in aa_bind_mount() but the path string written into it is not properly terminated before aa_dfa_match() iterates byte-by-byte looking for a terminator. KASAN observed the read occurring exactly 0 bytes past the end of the allocated region, confirming the DFA scanner walked off the heap object. The bug was originally reproduced on ARM64 (Qualcomm Snapdragon X1 / Lenovo hardware running Ubuntu 26.04) during routine mount operations performed by snap-update-ns, indicating the code path is reachable in default desktop configurations using snap packages.

Know when Qualcomm gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SUSE HIGH

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
May 30, 2026 - 11:22 NVD
7.1 (HIGH)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 14:17 nvd
UNKNOWN (no severity yet)
CVE Published
May 27, 2026 - 14:17 nvd
HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

apparmor: Fix string overrun due to missing termination

When booting Ubuntu 26.04 with Linux 7.0-rc4 on an ARM64 Qualcomm Snapdragon X1 we see a string buffer overrun:

BUG: KASAN: slab-out-of-bounds in aa_dfa_match (security/apparmor/match.c:535) Read of size 1 at addr ffff0008901cc000 by task snap-update-ns/2120

CPU: 5 UID: 60578 PID: 2120 Comm: snap-update-ns Not tainted 7.0.0-rc4+ #22 PREEMPTLAZY Hardware name: LENOVO 83ED/LNVNB161216, BIOS NHCN60WW 09/11/2025 Call trace: show_stack (arch/arm64/kernel/stacktrace.c:501) (C) dump_stack_lvl (lib/dump_stack.c:122) print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:597) __asan_report_load1_noabort (mm/kasan/report_generic.c:378) aa_dfa_match (security/apparmor/match.c:535) match_mnt_path_str (security/apparmor/mount.c:244 security/apparmor/mount.c:336) match_mnt (security/apparmor/mount.c:371) aa_bind_mount (security/apparmor/mount.c:447 (discriminator 4)) apparmor_sb_mount (security/apparmor/lsm.c:719 (discriminator 1)) security_sb_mount (security/security.c:1062 (discriminator 31)) path_mount (fs/namespace.c:4101) __arm64_sys_mount (fs/namespace.c:4172 fs/namespace.c:4361 fs/namespace.c:4338 fs/namespace.c:4338) invoke_syscall.constprop.0 (arch/arm64/kernel/syscall.c:35 arch/arm64/kernel/syscall.c:49) el0_svc_common.constprop.0 (./include/linux/thread_info.h:142 (discriminator 2) arch/arm64/kernel/syscall.c:140 (discriminator 2)) do_el0_svc (arch/arm64/kernel/syscall.c:152) el0_svc (arch/arm64/kernel/entry-common.c:80 arch/arm64/kernel/entry-common.c:725) el0t_64_sync_handler (arch/arm64/kernel/entry-common.c:744) el0t_64_sync (arch/arm64/kernel/entry.S:596)

Allocated by task 2120: kasan_save_stack (mm/kasan/common.c:58) kasan_save_track (./arch/arm64/include/asm/current.h:19 mm/kasan/common.c:70 mm/kasan/common.c:79) kasan_save_alloc_info (mm/kasan/generic.c:571) __kasan_kmalloc (mm/kasan/common.c:419) __kmalloc_noprof (./include/linux/kasan.h:263 mm/slub.c:5260 mm/slub.c:5272) aa_get_buffer (security/apparmor/lsm.c:2201) aa_bind_mount (security/apparmor/mount.c:442) apparmor_sb_mount (security/apparmor/lsm.c:719 (discriminator 1)) security_sb_mount (security/security.c:1062 (discriminator 31)) path_mount (fs/namespace.c:4101) __arm64_sys_mount (fs/namespace.c:4172 fs/namespace.c:4361 fs/namespace.c:4338 fs/namespace.c:4338) invoke_syscall.constprop.0 (arch/arm64/kernel/syscall.c:35 arch/arm64/kernel/syscall.c:49) el0_svc_common.constprop.0 (./include/linux/thread_info.h:142 (discriminator 2) arch/arm64/kernel/syscall.c:140 (discriminator 2)) do_el0_svc (arch/arm64/kernel/syscall.c:152) el0_svc (arch/arm64/kernel/entry-common.c:80 arch/arm64/kernel/entry-common.c:725) el0t_64_sync_handler (arch/arm64/kernel/entry-common.c:744) el0t_64_sync (arch/arm64/kernel/entry.S:596)

The buggy address belongs to the object at ffff0008901ca000 which belongs to the cache kmalloc-rnd-06-8k of size 8192 The buggy address is located 0 bytes to the right of allocated 8192-byte region [ffff0008901ca000, ffff0008901cc000)

The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9101c8 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:-1 pincount:0 flags: 0x8000000000000040(head|zone=2) page_type: f5(slab) raw: 8000000000000040 ffff000800016c40 fffffdffe2d14e10 ffff000800015c70 raw: 0000000000000000 0000000800010001 00000000f5000000 0000000000000000 head: 8000000000000040 ffff000800016c40 fffffdffe2d14e10 ffff000800015c70 head: 0000000000000000 0000000800010001 00000000f5000000 0000000000000000 head: 8000000000000003 fffffdffe2407201 fffffdffffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected

Memory state around the buggy address: ffff0008901cbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0008 ---truncated---

Executive ViewAI

Why It Matters

Linux systems in your environment are vulnerable to a kernel memory disclosure flaw that allows local system users to expose sensitive kernel data and cause service interruptions. The vulnerability affects kernel versions 7.0 through 7.0.3 and 7.1-rc1 when AppArmor is enabled; no public exploit identified at time of analysis. A patch is available and should be deployed immediately to maintain security and system stability.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

More in Qualcomm

View all
CVE-2013-2597 HIGH
8.4 Aug 31

Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6
CVE-2014-10031 HIGH POC
7.5 Jan 13

Buffer overflow in the IMAPd service in Qualcomm Eudora WorldMail 9.0.333.0 allows remote attackers to execute arbitrary
CVE-2025-21480 HIGH
8.6 Jun 03

Qualcomm GPU micronode contains a memory corruption vulnerability (CVE-2025-21480, CVSS 8.6) caused by unauthorized comm
CVE-2025-21479 HIGH
8.6 Jun 03

A second Qualcomm GPU micronode memory corruption vulnerability (CVE-2025-21479, CVSS 8.6) exists in the unauthorized co
CVE-2026-21385 HIGH POC
7.8 Mar 02

A Qualcomm chipset vulnerability (CVE-2026-21385) causes memory corruption through improper integer handling during memo
CVE-2025-27038 HIGH
7.5 Jun 03

Qualcomm Adreno GPU drivers in Chrome contain a use-after-free vulnerability (CVE-2025-27038, CVSS 7.5) enabling memory

CVE-2020-11117 CRITICAL POC
9.8 Sep 08

u'In the lbd service, an external user can issue a specially crafted debug command to overwrite arbitrary files with arb
CVE-2016-5348 MEDIUM POC
5.9 Oct 10

The GPS component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 be
CVE-2014-4322 HIGH POC
7.2 Dec 24

drivers/misc/qseecom.c in the QSEECOM driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Andr
CVE-2015-0569 HIGH POC
7.8 May 09

Heap-based buffer overflow in the private wireless extensions IOCTL implementation in wlan_hdd_wext.c in the WLAN (aka W
CVE-2017-8260 HIGH POC
7.8 Aug 18

In all Qualcomm products with Android releases from CAF using the Linux kernel, due to a type downcast, a value may impr
CVE-2016-3934 HIGH POC
7.8 Oct 10

drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_cci_i2c.c in the Qualcomm camera driver in Android before 2016

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/366278 REF https://git.kernel.org/stable/c/4b877ef27adc8ec187b0418629169856e7264e01 REF https://git.kernel.org/stable/c/828bf7929bedcb79b560b5b4e44f22abee07d31b

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy