Skip to main content

Linux Kernel CVE-2026-46328

| EUVDEUVD-2026-35429 HIGH
2026-06-09 Linux GHSA-2v6r-qcvm-x943
Information Disclosure Linux
7.3
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local shell in AppArmor-confined context
  2. Delivery
    Identify profile sets RLIMIT_CPU
  3. Exploit
    Create POSIX CPU timer via timer_create
  4. Execution
    Exceed intended CPU budget undetected
  5. Impact
    Disrupt timer accounting and host availability

Vulnerability Assessment

Exploitation Conditions

Requires (1) a Linux system running a vulnerable kernel with the AppArmor LSM enabled and active, (2) an AppArmor policy that sets a CPU-related rlimit (RLIMIT_CPU) on the target process, and (3) the attacker holding local code-execution capability as the confined low-privileged user (PR:L) able to create and arm POSIX CPU timers - no user interaction by another principal is needed (UI:N). Exploitation is limited by the local-only attack vector (AV:L, no network reachability), by the need for AppArmor to actually be in use with rlimit directives (default profiles on many distributions do not set RLIMIT_CPU), and by the impact being primarily availability/integrity of timer accounting rather than confidentiality or arbitrary code execution.
Impact

The provided CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H scores 7.3 and is consistent with a local, low-complexity, low-privilege bug whose primary impact is availability (high) with limited integrity impact and a scope change because AppArmor-enforced limits cross the trust boundary into kernel-wide timer state. Real-world urgency is low: EPSS is 0.02% at the 7th percentile, the CVE is not in CISA KEV, no public PoC is referenced, and exploitation requires the target system to actually use AppArmor with rlimit-bearing profiles. Signals are consistent - no conflicts between CVSS, EPSS, KEV, and PoC data - so this is best treated as a routine stable-tree kernel fix rather than an urgent patch-now issue. Notable data gap: the EUVD 'affected versions' list mixes commit ranges with patch tags such as '7.0' and '0' that appear to be placeholders rather than real kernel versions, so the exact introduced-in commit should be verified against the upstream commit baa73d9e478f before relying on the range.
Exploit ScenarioDerived

A local user permitted to run code inside an AppArmor profile that sets RLIMIT_CPU creates POSIX CPU timers and exercises long-running CPU workloads; because the AppArmor-applied rlimit is not propagated into the POSIX CPU timer state, the expected SIGXCPU enforcement or accounting behaves incorrectly, letting the process consume CPU beyond intent and destabilise other workloads (A:H) and tamper with timer-driven integrity expectations (I:L). No public exploit identified at time of analysis, and reproduction requires an AppArmor configuration that actively applies CPU rlimits.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 14, 2026

Local privilege/availability impact in the Linux kernel AppArmor subsystem stems from incomplete rlimit handling for POSIX CPU timers, where setting an rlimit through AppArmor policy did not propagate to the POSIX CPU timer machinery. A local low-privileged user operating under an AppArmor-confined profile can leverage the inconsistent limit enforcement to disrupt CPU-time accounting and cause high-impact availability effects on the system. No public exploit identified at time of analysis, and EPSS rates likelihood of exploitation at only 0.02% (7th percentile).

RemediationAI

Vendor-released patch: upgrade to one of the fixed stable kernels - 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.14, or mainline at or above the fix commit (6.19.4 line) - using the commit set published at git.kernel.org/stable/c/ (e.g. e1cc11550b2f, 2232d7cd2438, 28aa93fcfb33, 1f736dfe27c8, e43818b16815, 9bf1fa150775, 57d51d41b90e, 6ca56813f4a5). On distribution kernels, install the vendor security update that references CVE-2026-46328 and track the advisory via https://nvd.nist.gov/vuln/detail/CVE-2026-46328 and https://vuldb.com/vuln/369542. As an interim workaround on systems that cannot reboot quickly, avoid deploying AppArmor profiles that set RLIMIT_CPU on untrusted workloads, or move sensitive workloads off AppArmor-confined contexts that rely on CPU-time rlimits - the trade-off is loss of MAC-enforced CPU-time confinement until the kernel is patched; do not disable AppArmor system-wide as that removes a broad set of unrelated protections.

Affected VersionsENISA

Linux baa73d9e478ff32d62f3f9422822b59dd9a95a21 <28aa93fcfb33b6d580c5df4ae8b6d13fb0e6fcd3
Linux patch: 5.15.202
Linux patch: 7.0
Linux baa73d9e478ff32d62f3f9422822b59dd9a95a21 <57d51d41b90eface809b72e0e009b50546492f1f
Linux baa73d9e478ff32d62f3f9422822b59dd9a95a21 <2232d7cd243833ad750cae656d1817fe43744a09
Linux patch: 0
Linux patch: 6.19.4
Linux baa73d9e478ff32d62f3f9422822b59dd9a95a21 <e1cc11550b2f66687a374536c9dfdddcefca0efe
Linux patch: 6.18.14
Linux patch: 5.10.252
Linux baa73d9e478ff32d62f3f9422822b59dd9a95a21 <1f736dfe27c857b78f8461cd7c3dd9640be74b37
Linux baa73d9e478ff32d62f3f9422822b59dd9a95a21 <9bf1fa150775b0c6b794e4b6a2c0395e13777999
Linux 4.10
Linux baa73d9e478ff32d62f3f9422822b59dd9a95a21 <6ca56813f4a589f536adceb42882855d91fb1125
Linux patch: 6.6.128
Linux patch: 6.1.165
Linux patch: 6.12.75
Linux baa73d9e478ff32d62f3f9422822b59dd9a95a21 <e43818b16815c0c2bf933ef28316f8e704e5e0ef

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

AppArmor is the Linux Mandatory Access Control LSM that, among other things, can apply rlimit values to confined processes. POSIX CPU timers (per-process CPU consumption timers exposed via timer_create/setitimer with CLOCK_PROCESS_CPUTIME_ID and friends) require an additional update step in the timer subsystem when RLIMIT_CPU changes - simply writing the rlimit struct is not sufficient. The AppArmor rlimit path skipped that conditional update, leaving the kernel's POSIX CPU timer state desynchronised from the active rlimit. The affected component is the AppArmor LSM in mainline Linux (CPE cpe:2.3:a:linux:linux), with no CWE assigned by NVD but the bug class is effectively improper synchronisation of security/resource state across kernel subsystems.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.3 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
vuln.today AI 7.3 HIGH

Local confined process (AV:L, PR:L) reliably mis-applies an AppArmor rlimit into kernel timer state (AC:L, S:C), causing high availability and limited integrity impact with no confidentiality loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L
SUSE 6.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
Low
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 14, 2026 - 06:22 NVD
7.3 (HIGH)
Patch available
Jun 09, 2026 - 15:01 EUVD
CVE Published
Jun 09, 2026 - 12:25 cve.org
HIGH 7.3
CVE Published
Jun 09, 2026 - 12:25 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix rlimit for posix cpu timers

Posix cpu timers requires an additional step beyond setting the rlimit. Refactor the code so its clear when what code is setting the limit and conditionally update the posix cpu timers when appropriate.

Executive ViewAI

Why It Matters

A high-severity flaw in the Linux kernel AppArmor module (CVE-2026-46328, CVSS 7.3) allows confined users to circumvent CPU-time resource limits, causing system availability degradation. Organizations using AppArmor for security isolation face potential service disruptions and operational impact on affected systems. A vendor patch is available and deployment should be prioritized for production environments.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in Linux Kernel Memory and Network Vulnerabilities

View all 20
CVE-2026-46316 CRITICAL
9.3
CVE-2026-46327 HIGH
7.8
CVE-2026-46330 HIGH
7.8
CVE-2026-46325 CRITICAL
9.8
CVE-2026-46323 HIGH
7.8
CVE-2026-46320 HIGH
7.4
CVE-2026-46322 HIGH
7.1
CVE-2026-46332 HIGH
8.0
CVE-2026-46321 HIGH
7.1
CVE-2026-52907 HIGH
7.8
CVE-2026-46317 HIGH
8.8
CVE-2026-46318 MEDIUM
5.5
CVE-2026-46319 HIGH
7.8
CVE-2026-46324 HIGH
7.8
CVE-2026-46326 HIGH
8.4
CVE-2026-46329 MEDIUM
5.5
CVE-2026-52904 MEDIUM
5.5
CVE-2026-52905 MEDIUM
5.5
CVE-2026-52906 HIGH
7.7

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-46328 ADVISORY https://ubuntu.com/security/notices/USN-8492-1 ADVISORY https://vuldb.com/vuln/369542 REF https://git.kernel.org/stable/c/1f736dfe27c857b78f8461cd7c3dd9640be74b37 REF https://git.kernel.org/stable/c/2232d7cd243833ad750cae656d1817fe43744a09 REF https://git.kernel.org/stable/c/28aa93fcfb33b6d580c5df4ae8b6d13fb0e6fcd3 REF https://git.kernel.org/stable/c/57d51d41b90eface809b72e0e009b50546492f1f REF https://git.kernel.org/stable/c/6ca56813f4a589f536adceb42882855d91fb1125 REF https://git.kernel.org/stable/c/9bf1fa150775b0c6b794e4b6a2c0395e13777999 REF https://git.kernel.org/stable/c/e1cc11550b2f66687a374536c9dfdddcefca0efe REF https://git.kernel.org/stable/c/e43818b16815c0c2bf933ef28316f8e704e5e0ef

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy