Skip to main content

Linux Kernel EUVDEUVD-2026-32436

| CVE-2026-46054 HIGH
Improper Handling of Insufficient Permissions or Privileges (CWE-280)
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-xg2q-7399-f2r3
Information Disclosure Linux
7.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local unprivileged account on SELinux host
  2. Delivery
    Identify overlayfs mount with restricted lower layer
  3. Exploit
    Open accessible top-level user file
  4. Execution
    Invoke mmap()/mprotect() bypassing backing-file check
  5. Persist
    Read or modify protected backing file contents
  6. Impact
    Exfiltrate or tamper with isolated tenant data

Vulnerability Assessment

Weakness
CWE
CWE-280
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V8 - Authorization Insufficient permission handling
Exploitation Conditions

Exploitation requires (1) a Linux kernel built with SELinux and CONFIG_OVERLAY_FS, (2) SELinux in enforcing mode being relied on for isolation between the calling task and the overlayfs lower (backing) layer, (3) an active overlayfs mount where the attacker has at least read access to a top-level user file but the SELinux policy intends to deny direct access to the corresponding backing file via the mounter's credentials, and (4) the attacker having local shell or code execution as an unprivileged user (PR:L) able to issue mmap()/mprotect() syscalls on that file. Limiting factors per the CVSS vector: local attack vector only (no remote reachability), some privileges required, no user interaction, and scope unchanged - systems without overlayfs, without SELinux enforcement, or that do not rely on the SELinux overlayfs model for lower-layer confidentiality are not meaningfully exposed.
Impact

The CVSS 3.1 base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects local attack vector, low complexity, low privileges, no user interaction, and high confidentiality and integrity impact with no availability impact - consistent with a local user abusing overlayfs to read or alter backing files they should not reach. EPSS of 0.02% (5th percentile) and absence from CISA KEV indicate no observed mass exploitation, and no public exploit identified at time of analysis. Real-world risk is concentrated in multi-tenant or container hosts where overlayfs is heavily used (e.g., Docker, Podman, Kubernetes nodes) and SELinux is the relied-upon isolation boundary; on systems without SELinux enforcing or without overlayfs in use, the practical exposure is negligible. No conflicting signals were observed, but the CWE field is N/A in input - class is inferred from the patch description rather than confirmed by NVD.
Exploit ScenarioDerived

A local user on a multi-tenant host that uses SELinux-enforced overlayfs (e.g., a container runtime root) opens a top-level overlay file they are entitled to and issues mmap() or mprotect() against it, causing the kernel to operate on the lower backing file without the mounter-credential check, yielding read or modify access to data that SELinux policy was intended to deny. No public exploit identified at time of analysis, and CVSS AV:L/AC:L/PR:L means a logged-in or container-confined user is the realistic attacker, not a remote one.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 30, 2026

Local privilege-bounded information disclosure and integrity compromise in the Linux kernel's SELinux module affects overlayfs mounts where mmap() and mprotect() operations bypass the intended dual-credential access checks. A local authenticated user with access to an overlayfs top-level (user) file can map or change protections on backing files without the mounter's credentials being properly evaluated, undermining the SELinux overlayfs security model. EPSS is very low (0.02%, 5th percentile) and no public exploit identified at time of analysis.

RemediationAI

Vendor-released patch: Linux 7.0.4 (stable) and 7.1-rc1 (mainline) - upgrade to a kernel that includes commits 82544d36b1729153c8aeb179e84750f0c085d3b1 and cd0e707a927a70cdfd8bc5a512a9719a87f5ed51, available at https://git.kernel.org/stable/c/82544d36b1729153c8aeb179e84750f0c085d3b1 and https://git.kernel.org/stable/c/cd0e707a927a70cdfd8bc5a512a9719a87f5ed51, and consume distribution kernel updates (RHEL/Fedora/Ubuntu/SUSE) once they backport these commits. Where immediate kernel update is infeasible, compensating controls include avoiding overlayfs for security-sensitive mounts (use a different stackable or direct bind mount, accepting loss of layered image semantics for containers), restricting which users can execute workloads on overlayfs-backed roots, and tightening SELinux policy to deny mmap/mprotect on the relevant file_t types used by lower layers (trade-off: may break legitimate container workloads that legitimately mmap shared libraries from images). Disabling SELinux is not a workaround and would worsen exposure.

Affected VersionsENISA

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <82544d36b1729153c8aeb179e84750f0c085d3b1
Linux patch: 7.0.4
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <cd0e707a927a70cdfd8bc5a512a9719a87f5ed51
Linux 0 <7.0.4
Linux patch: 7.1-rc1

Affected Packages

euvd linux fix: 7.0.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Overlayfs is a stackable union filesystem in Linux that presents a merged view of an upper (writable) layer and one or more lower (read-only) layers; SELinux normally enforces a two-step check that the calling task can access the visible 'user' file and that the mounter's credentials can access the underlying 'backing' file. Prior to this fix, the mmap() and mprotect() syscall paths did not invoke the backing-file enforcement, so the lower-layer access check was effectively skipped for memory-mapped operations. The patch introduces use of the new security_mmap_backing_file() LSM hook and the backing-file API/LSM blob so that the backing credential check is consistently applied at map and protection-change time. The CWE is unspecified by NVD, but the issue belongs to the access-control-bypass / missing authorization class (CWE-862/285 family) in an LSM enforcement path.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
SUSE HIGH
Red Hat 7.0 HIGH

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

4
CVSS changed
May 30, 2026 - 11:22 NVD
7.1 (HIGH)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 14:17 nvd
UNKNOWN (no severity yet)
CVE Published
May 27, 2026 - 14:17 nvd
HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

selinux: fix overlayfs mmap() and mprotect() access checks

The existing SELinux security model for overlayfs is to allow access if the current task is able to access the top level file (the "user" file) and the mounter's credentials are sufficient to access the lower level file (the "backing" file). Unfortunately, the current code does not properly enforce these access controls for both mmap() and mprotect() operations on overlayfs filesystems.

This patch makes use of the newly created security_mmap_backing_file() LSM hook to provide the missing backing file enforcement for mmap() operations, and leverages the backing file API and new LSM blob to provide the necessary information to properly enforce the mprotect() access controls.

Executive ViewAI

Why It Matters

CVE-2026-46054 in Linux kernel's SELinux module allows local authenticated users to bypass access controls on overlayfs-configured filesystems, potentially enabling privilege escalation or unauthorized data access. The vulnerability affects organizations deploying Linux with overlayfs storage in container and virtualization environments. With no public exploits identified and extremely low exploitation probability (0.02% EPSS), the risk remains manageable through vendor patching.

Business Impact: Medium
Compensating Controls

Apply vendor patch. If immediate patching is not feasible, restrict local user access to overlayfs-mounted filesystems and disable overlayfs storage drivers in container runtimes where operationally possible.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-280 – Improper Handling of Insufficient Permissions or Privileges

View all
CVE-2024-24116 CRITICAL POC
9.8
CVE-2024-25108 HIGH POC
8.8
CVE-2023-27087 HIGH POC
7.5
CVE-2022-4863 MEDIUM POC
6.5
CVE-2021-38312 MEDIUM POC
6.5
CVE-2025-46066 CRITICAL
9.9
CVE-2024-46988 MEDIUM POC
5.7
CVE-2026-41566 CRITICAL
9.4

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8488-1 ADVISORY https://ubuntu.com/security/notices/USN-8489-1 ADVISORY https://vuldb.com/vuln/366283 REF https://access.redhat.com/errata/RHSA-2026:25191 REF https://access.redhat.com/errata/RHSA-2026:27811 REF https://access.redhat.com/errata/RHSA-2026:27812 REF https://access.redhat.com/errata/RHSA-2026:30848 REF https://access.redhat.com/errata/RHSA-2026:51746 REF https://access.redhat.com/errata/RHSA-2026:52649 REF https://access.redhat.com/errata/RHSA-2026:52667 REF https://access.redhat.com/errata/RHSA-2026:52764 REF https://access.redhat.com/errata/RHSA-2026:59091 REF https://access.redhat.com/errata/RHSA-2026:59473 REF https://access.redhat.com/errata/RHSA-2026:67721 REF https://access.redhat.com/errata/RHSA-2026:67723 REF https://access.redhat.com/security/cve/CVE-2026-46054 REF https://bugzilla.redhat.com/show_bug.cgi?id=2482025 REF https://git.kernel.org/stable/c/82544d36b1729153c8aeb179e84750f0c085d3b1 REF https://git.kernel.org/stable/c/8bacd09f12c27710228562e4d13163e58c5f4a45 REF https://git.kernel.org/stable/c/bc6c380c1159de52a252ed11f19a42c47f60a735 REF https://git.kernel.org/stable/c/cd0e707a927a70cdfd8bc5a512a9719a87f5ed51 REF https://git.kernel.org/stable/c/d844702198395d3f80222777030f69db6be6b709 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46054.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy