ptrace: slightly saner ‘get_dumpable()’ logic_CVE-2026-46333

5.5 / 10

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

In the Linux kernel, the following vulnerability has been resolved:

ptrace: slightly saner 'get_dumpable()' logic

The 'dumpability' of a task is fundamentally about the memory image of
the task - the concept comes from whether it can core dump or not - and
makes no sense when you don't have an associated mm.

And almost all users do in fact use it only for the case where the task
has a mm pointer.

But we have one odd special case: ptrace_may_access() uses 'dumpable' to
check various other things entirely independently of the MM (typically
explicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for
threads that no longer have a VM (and maybe never did, like most kernel
threads).

It's not what this flag was designed for, but it is what it is.

The ptrace code does check that the uid/gid matches, so you do have to
be uid-0 to see kernel thread details, but this means that the
traditional "drop capabilities" model doesn't make any difference for
this all.

Make it all make a *bit* more sense by saying that if you don't have a
MM pointer, we'll use a cached "last dumpability" flag if the thread
ever had a MM (it will be zero for kernel threads since it is never
set), and require a proper CAP_SYS_PTRACE capability to override.

Basic Information

ID CVE-2026-46333

Source Linux

Published May 15, 2026 at 12:58

Modified May 18, 2026 at 12:53

Affected Product

Vendor Linux

Product Linux

Version bfedb589252c01fa505ac9f6f2a3d5d68d707ef4

Affected Versions Linux Linux bfedb589252c01fa505ac9f6f2a3d5d68d707ef4
Linux Linux bfedb589252c01fa505ac9f6f2a3d5d68d707ef4
Linux Linux bfedb589252c01fa505ac9f6f2a3d5d68d707ef4
Linux Linux bfedb589252c01fa505ac9f6f2a3d5d68d707ef4
Linux Linux bfedb589252c01fa505ac9f6f2a3d5d68d707ef4
Linux Linux bfedb589252c01fa505ac9f6f2a3d5d68d707ef4
Linux Linux bfedb589252c01fa505ac9f6f2a3d5d68d707ef4
Linux Linux bfedb589252c01fa505ac9f6f2a3d5d68d707ef4
Linux Linux d5b3e840dbf6dd2c0f30b5982b6f5ecd49e46b12
Linux Linux 03eed7afbc09e061f66b448daf7863174c3dc3f3
Linux Linux e45692fa1aea06676449b63ef3c2b6e1e72b7578
Linux Linux 694a95fa6dae4991f16cda333d897ea063021fed
Linux Linux 4.10

CWE Classification

CWE-269

References

{
    "lastseen": "",
    "description": "In the Linux kernel, the following vulnerability has been resolved:\n\nptrace: slightly saner 'get_dumpable()' logic\n\nThe 'dumpability' of a task is fundamentally about the memory image of\nthe task - the concept comes from whether it can core dump or not - and\nmakes no sense when you don't have an associated mm.\n\nAnd almost all users do in fact use it only for the case where the task\nhas a mm pointer.\n\nBut we have one odd special case: ptrace_may_access() uses 'dumpable' to\ncheck various other things entirely independently of the MM (typically\nexplicitly using flags like PTRACE_MODE_READ_FSCREDS).  Including for\nthreads that no longer have a VM (and maybe never did, like most kernel\nthreads).\n\nIt's not what this flag was designed for, but it is what it is.\n\nThe ptrace code does check that the uid/gid matches, so you do have to\nbe uid-0 to see kernel thread details, but this means that the\ntraditional \"drop capabilities\" model doesn't make any difference for\nthis all.\n\nMake it all make a *bit* more sense by saying that if you don't have a\nMM pointer, we'll use a cached \"last dumpability\" flag if the thread\never had a MM (it will be zero for kernel threads since it is never\nset), and require a proper CAP_SYS_PTRACE capability to override.",
    "published": "2026-05-15T12:58:44.599Z",
    "modified": "2026-05-18T12:53:44.277Z",
    "type": "cve",
    "title": "ptrace: slightly saner 'get_dumpable()' logic",
    "source": "Linux",
    "references": "https://git.kernel.org/stable/c/93d4ba49d18e3d7fb41a9927c2d0cca5e9dfefd6\nhttps://git.kernel.org/stable/c/15b828a46f305ae9f05a7c16914b3ce273474205\nhttps://git.kernel.org/stable/c/4709234fd1b95136ceb789f639b1e7ea5de1b181\nhttps://git.kernel.org/stable/c/8f907d345bae8f4b3f004c5abc56bf2dfb851ea7\nhttps://git.kernel.org/stable/c/6e5b51e74a40d377bcd3081dd33fbaa0e1aa7e3d\nhttps://git.kernel.org/stable/c/2a93a4fac7b6051d3be7cd1b015fe7320cd0404d\nhttps://git.kernel.org/stable/c/01363cb3fbd0238ffdeb09f53e9039c9edf8a730\nhttps://git.kernel.org/stable/c/31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a",
    "id": "CVE-2026-46333",
    "bulletinFamily": "",
    "cwe": [
        "CWE-269"
    ],
    "cvelist": null,
    "sourceData": "Linux Linux bfedb589252c01fa505ac9f6f2a3d5d68d707ef4\nLinux Linux bfedb589252c01fa505ac9f6f2a3d5d68d707ef4\nLinux Linux bfedb589252c01fa505ac9f6f2a3d5d68d707ef4\nLinux Linux bfedb589252c01fa505ac9f6f2a3d5d68d707ef4\nLinux Linux bfedb589252c01fa505ac9f6f2a3d5d68d707ef4\nLinux Linux bfedb589252c01fa505ac9f6f2a3d5d68d707ef4\nLinux Linux bfedb589252c01fa505ac9f6f2a3d5d68d707ef4\nLinux Linux bfedb589252c01fa505ac9f6f2a3d5d68d707ef4\nLinux Linux d5b3e840dbf6dd2c0f30b5982b6f5ecd49e46b12\nLinux Linux 03eed7afbc09e061f66b448daf7863174c3dc3f3\nLinux Linux e45692fa1aea06676449b63ef3c2b6e1e72b7578\nLinux Linux 694a95fa6dae4991f16cda333d897ea063021fed\nLinux Linux 4.10",
    "sourceHref": "",
    "cvss": {
        "score": 5.5,
        "severity": "MEDIUM",
        "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Linux",
    "version": "bfedb589252c01fa505ac9f6f2a3d5d68d707ef4",
    "vendor": "Linux",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}