Linux Kernel CVE-2026-46104

The Linux Security Module (LSM) framework supports stacked configurations where multiple LSMs (e.g., SELinux alongside Lockdown, BPF LSM, or AppArmor) share a composite security blob per kernel object. Each LSM's per-object state is stored at a calculated offset within that blob, not necessarily at offset zero. The affected code in the SELinux subsystem - specifically sock_has_perm() and nlmsg_sock_has_extended_perms() - bypasses the selinux_sock() accessor and reads sk->sk_security directly, assuming offset zero. In a stacked configuration where a preceding LSM claims blob storage before SELinux, this direct dereference lands in the wrong LSM's data region. The result is that garbage or foreign SID (Security Identifier) and class values are passed into AVC checks, which can trigger kernel panics or bypass intended policy enforcement. The CWE is not formally assigned, but this is structurally a pointer arithmetic/offset confusion error within kernel shared memory management. Affected product scope per CPE: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* covering kernel versions from the introduction commit d1d991efaf34606d500dcbd28bedc0666eeec8e2 up to (but not including) the fix commits.