Linux Kernel CVE-2026-46302

Exploitation requires a local, authenticated low-privileged account on a Linux system where SELinux is enabled and enforcing (or permissive). The attacker must be able to call open() on /sys/fs/selinux/policy, which is accessible to unprivileged users by default on SELinux-enabled kernels. The denial-of-service is only meaningful when a concurrent process or daemon attempts to open the same file - making impact contingent on the presence of SELinux-consuming tooling (policy loaders, audit tools, IDS agents). Exploitation is strictly local (AV:L); no network exposure exists. The vulnerability does not affect systems where SELinux is disabled or absent. Root or elevated privileges are not required, but the attacker must have an established local session.

The CVSS 3.1 score of 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately reflects the threat model: local access with low privileges is required, and the sole impact is availability - no confidentiality or integrity is affected. The EPSS score of 0.02% (5th percentile) is consistent with the low exploitability profile: this is a simple file-descriptor hold, but the damage is confined to SELinux policy-reading operations rather than arbitrary system disruption. The vulnerability is not listed in CISA KEV and no public proof-of-concept has been identified. The tags in the intelligence data label this 'Information Disclosure,' which conflicts with the CVSS impact (A:H only, C:N/I:N) and the description - this appears to be a tagging error; the actual impact is a localized denial of service against SELinux tooling. Real-world priority is low: exploitation requires an existing foothold on the system, and the disruption is limited to processes that concurrently attempt to read /sys/fs/selinux/policy. Defenders should treat this as a routine kernel maintenance patch rather than an urgent remediation.

A local attacker with a low-privileged shell on a SELinux-enforcing Linux system opens /sys/fs/selinux/policy and deliberately holds the file descriptor open in a loop or background process. Any concurrently running security tool - such as a policy reload daemon, audit2allow, or an intrusion detection component that reads the active policy - will fail to open the same file and may malfunction or crash, degrading the system's SELinux-enforced security posture. No public proof-of-concept code has been identified; the attack primitive is trivially constructable from a standard open() syscall.