Skip to main content

Linux Kernel CVE-2026-46333

| EUVDEUVD-2026-30540 HIGH
Improper Privilege Management (CWE-269)
2026-05-15 Linux GHSA-pm8f-4p6p-6x53
Privilege Escalation Linux
7.1
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local shell as relevant uid
  2. Delivery
    Identify target kernel thread or mm-less task
  3. Exploit
    Invoke ptrace with PTRACE_MODE_READ_FSCREDS
  4. Execution
    Bypass dropped-capability check via get_dumpable() flaw
  5. Persist
    Read protected kernel thread credentials/state
  6. Impact
    Leverage leaked data for further privilege escalation

Vulnerability Assessment

Weakness
CWE
CWE-269
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires local code execution on the target Linux host as a user matching the uid/gid of the target task (typically uid-0, since kernel-thread inspection is the high-value case), and the ability to invoke ptrace with PTRACE_MODE_READ_FSCREDS-style checks against a task that has no mm pointer (kernel threads, or threads that have released their mm). The bug specifically defeats the 'drop capabilities to harden a root process' model: a process that started as root and dropped CAP_SYS_PTRACE can still reach data the capability drop was meant to protect. Exploitation is limited by the need for local access (CVSS AV:L), and the practical impact is constrained to environments that rely on capability-dropping as a security boundary - pure container escapes or remote attacks are not enabled by this flaw alone.
Impact

CVSS 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) classifies this as a local, low-complexity, low-privilege vulnerability with high confidentiality and integrity impact but no availability impact - consistent with a privilege/access-control flaw rather than a memory-corruption RCE. CISA SSVC rates exploitation as 'poc' (proof-of-concept available), automatable 'no', and technical impact 'partial', which aligns with a targeted escalation rather than mass-exploitable bug. EPSS at 0.02% (4th percentile) reinforces low real-world exploitation likelihood, and the CVE is not in CISA KEV. However, the presence of a public GitHub PoC (ssh-keysign-pwn) and OSS-security discussion elevates this above pure theoretical risk for multi-user systems, container hosts, and environments relying on capability-dropping as a hardening boundary. Note: the CVE ID uses a future year (2026-46333) and the description references the assistant's knowledge cutoff window - patch versions and exploit specifics should be re-verified against current kernel.org advisories.
Exploit ScenarioDerived

A local attacker with uid-0 but with capabilities dropped (e.g., a setuid helper like ssh-keysign that drops privileges, or a process inside a hardened container) uses ptrace against a kernel thread or a task without an mm to leak fscred-protected information that should have been gated by CAP_SYS_PTRACE. The public PoC at github.com/0xdeadbeefnetwork/ssh-keysign-pwn demonstrates this against ssh-keysign, abusing the ptrace_may_access() path to obtain data that escapes the capability sandbox. Attack complexity is low and no user interaction is required, but the attacker must already have local code execution as a relevant uid.
Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – May 20, 2026

Local privilege escalation in the Linux kernel ptrace subsystem allows authenticated users to bypass the traditional capability-dropping security model when accessing kernel thread details via PTRACE_MODE_READ_FSCREDS checks. The flaw stems from get_dumpable() logic returning misleading values for tasks without an associated memory map (mm), enabling uid-0 processes that have dropped capabilities to still read sensitive kernel thread information. Publicly available exploit code exists (referenced in OSS-security and a GitHub PoC against ssh-keysign), though EPSS scoring (0.02%) indicates low likelihood of widespread exploitation.

Earlier versions of this analysis (1)
v1 May 18, 2026 - 13:23 CVSS 5.5

Improper privilege management in the Linux kernel's ptrace subsystem allows a local low-privileged attacker to read sensitive information from kernel threads and capability-dropped processes by exploiting flawed dumpability logic in ptrace_may_access(). The vulnerability stems from the misuse of the task dumpability flag - originally a core-dump concept tied to the process memory image - for access-control decisions on threads that have no MM (memory map), such as kernel threads. No public exploit identified at time of analysis in CISA KEV, but a proof-of-concept leveraging ssh-keysign is publicly referenced on GitHub, and EPSS remains very low at 0.02% (4th percentile), suggesting no widespread exploitation.

RemediationAI

Vendor-released patches are available - upgrade to Linux kernel 5.10.256, 5.15.207, 6.1.173, 6.6.139, 6.12.89, 6.18.31, or 7.0.8 (whichever matches your stable branch) per the kernel.org stable commits and Debian LTS announcements (https://lists.debian.org/debian-lts-announce/2026/05/msg00032.html). Distribution users should apply vendor-backported updates as they appear (Debian, Ubuntu, RHEL, SUSE). As a compensating control until patching, restrict shell access to trusted users only and audit any setuid/capability-bearing binaries that rely on ptrace permission boundaries (notably ssh-keysign, which is the subject of the public PoC), since removing or chmod 0700'ing ssh-keysign disables host-based authentication but breaks that feature. Consider enabling /proc/sys/kernel/yama/ptrace_scope=2 or 3 to restrict ptrace to CAP_SYS_PTRACE holders only, accepting that this will break legitimate debuggers like gdb attaching to running processes.

Affected VersionsENISA

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <8f907d345bae8f4b3f004c5abc56bf2dfb851ea7
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <93d4ba49d18e3d7fb41a9927c2d0cca5e9dfefd6
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <15b828a46f305ae9f05a7c16914b3ce273474205
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <2a93a4fac7b6051d3be7cd1b015fe7320cd0404d
Linux patch: 6.6.139
Linux patch: 7.0.8
Linux patch: 6.18.31
Linux patch: 5.15.207
Linux patch: 5.10.256
Linux patch: 6.1.173
Linux patch: 6.12.89
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <4709234fd1b95136ceb789f639b1e7ea5de1b181
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <01363cb3fbd0238ffdeb09f53e9039c9edf8a730
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <6e5b51e74a40d377bcd3081dd33fbaa0e1aa7e3d

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in the Linux kernel's ptrace subsystem, specifically in how ptrace_may_access() uses the 'dumpable' flag from get_dumpable() to gate access decisions. The 'dumpable' concept was originally designed around core-dump eligibility tied to a task's memory image (mm_struct), but ptrace repurposes it for access control even on tasks without an mm - such as kernel threads. This creates a CWE-269 (Improper Privilege Management) condition where the standard capability model (drop CAP_SYS_PTRACE to limit access) becomes ineffective for kernel-thread inspection. The fix caches a 'last dumpability' flag for tasks that once had an mm (zero for kernel threads that never had one) and requires explicit CAP_SYS_PTRACE to override.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Red Hat 7.8 HIGH

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

6
Analysis Updated
May 20, 2026 - 17:29 vuln.today
v2 - CVSS changed
Severity Changed
May 20, 2026 - 17:22 NVD
MEDIUM HIGH
CVSS changed
May 20, 2026 - 17:22 NVD
5.5 (MEDIUM) 7.1 (HIGH)
CVSS changed
May 18, 2026 - 13:22 NVD
5.5 (MEDIUM)
Patch available
May 15, 2026 - 15:02 EUVD
CVE Published
May 15, 2026 - 12:58 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ptrace: slightly saner 'get_dumpable()' logic

The 'dumpability' of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and makes no sense when you don't have an associated mm.

And almost all users do in fact use it only for the case where the task has a mm pointer.

But we have one odd special case: ptrace_may_access() uses 'dumpable' to check various other things entirely independently of the MM (typically explicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for threads that no longer have a VM (and maybe never did, like most kernel threads).

It's not what this flag was designed for, but it is what it is.

The ptrace code does check that the uid/gid matches, so you do have to be uid-0 to see kernel thread details, but this means that the traditional "drop capabilities" model doesn't make any difference for this all.

Make it all make a *bit* more sense by saying that if you don't have a MM pointer, we'll use a cached "last dumpability" flag if the thread ever had a MM (it will be zero for kernel threads since it is never set), and require a proper CAP_SYS_PTRACE capability to override.

Executive ViewAI

Why It Matters

A local privilege escalation vulnerability in Linux kernel ptrace functionality (CVE-2026-46333) allows authenticated users with system access to escalate privileges and extract sensitive kernel information. Publicly available exploit code exists, increasing risk for organizations using affected Linux systems. Any compromised user account could be leveraged to gain administrative control, potentially exposing all system data and enabling further attacks.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

Threat Score
4.9/10
Composite threat intelligence
EPSS Score
0.0%
Top 96% exploitable
Threat Intel
3
1 sources
Exploit
POC
Public exploit code exists
Social Media
1
Sightings
Data Quality
9 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment CISA MSRC POC (1) Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
Poc
System Exposure· derived
Small
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

66
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: +20
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Same weakness CWE-269 – Improper Privilege Management

View all
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2012-3993 CRITICAL POC
9.3
CVE-2017-11467 CRITICAL POC
9.8
CVE-2014-1510 CRITICAL POC
9.8
CVE-2014-1511 CRITICAL POC
9.8
CVE-2019-1405 HIGH POC
7.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:5.4.4.5.109 Image SLES15-SP4-BYOS Image SLES15-SP4-BYOS-Azure Image SLES15-SP4-BYOS-EC2 Image SLES15-SP4-BYOS-GCE Image SLES15-SP4-CHOST-BYOS Image SLES15-SP4-CHOST-BYOS-Aliyun Image SLES15-SP4-CHOST-BYOS-Azure Image SLES15-SP4-CHOST-BYOS-EC2 Image SLES15-SP4-CHOST-BYOS-GCE Image SLES15-SP4-CHOST-BYOS-SAP-CCloud Image SLES15-SP4-HPC-BYOS Image SLES15-SP4-HPC-BYOS-Azure Image SLES15-SP4-HPC-BYOS-EC2 Image SLES15-SP4-HPC-BYOS-GCE Image SLES15-SP4-HPC-EC2 Image SLES15-SP4-HPC-GCE Image SLES15-SP4-Hardened-BYOS Image SLES15-SP4-Hardened-BYOS-Azure Image SLES15-SP4-Hardened-BYOS-EC2 Image SLES15-SP4-Hardened-BYOS-GCE Image SLES15-SP4-SAP Image SLES15-SP4-SAP-Azure Image SLES15-SP4-SAP-EC2 Image SLES15-SP4-SAP-GCE Image SLES15-SP4-SAPCAL Image SLES15-SP4-SAPCAL-Azure Image SLES15-SP4-SAPCAL-EC2 Image SLES15-SP4-SAPCAL-GCE Affected
Container suse/sle-micro/base-5.5:2.0.4-5.8.274 Image SLES15-SP5-BYOS-Azure Image SLES15-SP5-BYOS-EC2 Image SLES15-SP5-BYOS-GCE Image SLES15-SP5-CHOST-BYOS-Aliyun Image SLES15-SP5-CHOST-BYOS-Azure Image SLES15-SP5-CHOST-BYOS-EC2 Image SLES15-SP5-CHOST-BYOS-GCE Image SLES15-SP5-CHOST-BYOS-GDC Image SLES15-SP5-CHOST-BYOS-SAP-CCloud Image SLES15-SP5-EC2 Image SLES15-SP5-GCE Image SLES15-SP5-HPC-BYOS-Azure Image SLES15-SP5-HPC-BYOS-EC2 Image SLES15-SP5-HPC-BYOS-GCE Image SLES15-SP5-Hardened-BYOS-Azure Image SLES15-SP5-Hardened-BYOS-EC2 Image SLES15-SP5-Hardened-BYOS-GCE Image SLES15-SP5-SAPCAL-Azure Image SLES15-SP5-SAPCAL-EC2 Image SLES15-SP5-SAPCAL-GCE Affected
Container suse/sle-micro/kvm-5.5:2.0.4-3.5.529 Affected
Container suse/sle-micro/rt-5.5:2.0.4-4.5.586 Affected
Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-174-06 ICSA-26-209-04 ICSA-26-295-11
Sources: Microsoft MSRC, Metasploit/Nuclei, CISA (public domain)

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:19521 ADVISORY https://access.redhat.com/errata/RHSA-2026:19540 ADVISORY https://access.redhat.com/errata/RHSA-2026:19568 ADVISORY https://access.redhat.com/errata/RHSA-2026:19569 ADVISORY https://access.redhat.com/errata/RHSA-2026:19664 ADVISORY https://access.redhat.com/errata/RHSA-2026:19666 ADVISORY https://access.redhat.com/errata/RHSA-2026:19705 ADVISORY https://access.redhat.com/errata/RHSA-2026:19711 ADVISORY https://access.redhat.com/errata/RHSA-2026:19875 ADVISORY https://access.redhat.com/errata/RHSA-2026:20051 ADVISORY https://access.redhat.com/errata/RHSA-2026:20054 ADVISORY https://access.redhat.com/errata/RHSA-2026:20129 ADVISORY https://access.redhat.com/errata/RHSA-2026:20130 ADVISORY https://access.redhat.com/errata/RHSA-2026:20299 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-46333 ADVISORY https://ubuntu.com/security/notices/USN-8370-1 ADVISORY https://ubuntu.com/security/notices/USN-8371-1 ADVISORY https://vuldb.com/vuln/364178 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1899/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1900/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1904/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1907/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1908/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1909/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1959/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1978/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21719/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21720/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21721/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21724/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21734/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21735/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21745/ REF http://www.openwall.com/lists/oss-security/2026/05/15/9 REF http://www.openwall.com/lists/oss-security/2026/05/20/14 REF http://www.openwall.com/lists/oss-security/2026/05/20/16 REF https://access.redhat.com/errata/RHSA-2026:20593 REF https://access.redhat.com/errata/RHSA-2026:21701 REF https://access.redhat.com/errata/RHSA-2026:21702 REF https://access.redhat.com/errata/RHSA-2026:23468 REF https://access.redhat.com/errata/RHSA-2026:23469 REF https://access.redhat.com/errata/RHSA-2026:23470 REF https://access.redhat.com/errata/RHSA-2026:23471 REF https://access.redhat.com/errata/RHSA-2026:24814 REF https://access.redhat.com/errata/RHSA-2026:33486 REF https://access.redhat.com/security/cve/CVE-2026-46333 REF https://bugzilla.redhat.com/show_bug.cgi?id=2477802 REF https://cert-portal.siemens.com/productcert/html/ssa-019113.html REF https://cert-portal.siemens.com/productcert/html/ssa-457936.html REF https://git.kernel.org/stable/c/01363cb3fbd0238ffdeb09f53e9039c9edf8a730 REF https://git.kernel.org/stable/c/15b828a46f305ae9f05a7c16914b3ce273474205 REF https://git.kernel.org/stable/c/2a93a4fac7b6051d3be7cd1b015fe7320cd0404d REF https://git.kernel.org/stable/c/31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a REF https://git.kernel.org/stable/c/4709234fd1b95136ceb789f639b1e7ea5de1b181 REF https://git.kernel.org/stable/c/6e5b51e74a40d377bcd3081dd33fbaa0e1aa7e3d REF https://git.kernel.org/stable/c/8f907d345bae8f4b3f004c5abc56bf2dfb851ea7 REF https://git.kernel.org/stable/c/93d4ba49d18e3d7fb41a9927c2d0cca5e9dfefd6 REF https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn/ REF https://lists.debian.org/debian-lts-announce/2026/05/msg00032.html REF https://lists.debian.org/debian-lts-announce/2026/05/msg00035.html REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46333.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy