CVE-2026-46104

Technical summary

CVE-2026-46104 is a SELinux LSM vulnerability in the Linux kernel stemming from incorrect socket blob accessor usage. The functions sock_has_perm() and nlmsg_sock_has_extended_perms() directly dereference sk->sk_security, which assumes the SELinux socket blob occupies offset zero in the composite LSM blob structure. In stacked LSM configurations where another module allocates socket blob storage before SELinux, this assumption fails. These helpers then read attacker-controlled or garbage data from the wrong blob offset, passing invalid SID and class values to AVC permission checks. The fix involves replacing direct pointer dereference with the selinux_sock() accessor function, which correctly handles blob offset calculations in stacked configurations.

Business impact

Organizations running Linux systems with stacked LSM configurations (such as SELinux combined with AppArmor or other modules) face potential denial-of-service conditions through kernel crashes triggered by invalid security checks. Permission enforcement may also be compromised if incorrect security contexts are applied, potentially allowing or denying legitimate operations unpredictably. The impact is primarily availability-focused but carries secondary integrity risks in environments relying on SELinux for mandatory access control.

Affected systems

The Linux kernel is affected. The vulnerability is specific to configurations where SELinux operates alongside other LSM modules in a stacked arrangement. Standard deployments running SELinux alone are not vulnerable because the blob offset assumption holds true. Systems with both SELinux and AppArmor, SELinux and SMACK, or other multi-LSM stacks are at risk. Affected versions require patches to the kernel's SELinux socket permission helper functions.

Exploitability

Exploitation requires local access to the affected system and the ability to trigger socket operations that invoke the vulnerable code paths. The vulnerability cannot be exploited remotely. A local attacker or unprivileged process triggering socket permission checks in a stacked LSM environment can cause kernel panics or trigger unexpected permission denials. The CVSS 3.1 score of 5.5 (Medium) reflects local access requirements and local impact scope, though availability impact is rated high.

Remediation

Apply kernel updates that replace direct sk->sk_security dereferences with the selinux_sock() accessor in socket permission helper functions. System administrators should verify their kernel version against the vendor's advisory for patched releases. The fix is straightforward and poses no compatibility risk; it simply corrects the blob accessor pattern to work correctly in all LSM configurations.

Patch guidance

Verify the patched kernel version against your Linux distribution's security advisory. The fix involves updating socket permission helper functions to use selinux_sock() instead of direct pointer access. Most distributions will provide kernel updates through standard package management tools. Test patches in non-production environments first, especially in systems relying on SELinux for security policy enforcement, to ensure policy evaluation remains consistent.

Detection guidance

Monitor kernel logs and system messages for unexpected permission denials or AVC audit entries from socket operations, particularly in systems with stacked LSMs. Watch for kernel panics or oops messages referencing SELinux socket functions (sock_has_perm, nlmsg_sock_has_extended_perms). Systems not currently running stacked LSM configurations are unaffected and require no immediate monitoring, though they should still apply available patches proactively.

Why prioritize this

Prioritize patching based on your LSM configuration. Systems running SELinux with other LSMs (AppArmor, SMACK, Tomoyo) should treat this as a high-priority kernel update due to direct availability risk. Standard SELinux-only deployments can address this through regular kernel maintenance windows, as the practical attack surface is narrower. The CVSS 5.5 rating is appropriate for local, privilege-required impact, but the criticality in stacked LSM environments justifies accelerated treatment in those architectures.

Risk score, explained

The CVSS 3.1 score of 5.5 (Medium) reflects: Attack Vector = Local (requires system access), Attack Complexity = Low (straightforward triggering of socket operations), Privileges Required = Low (unprivileged users can trigger vulnerable paths), User Interaction = None, Scope = Unchanged, Confidentiality = None, Integrity = None, and Availability = High (kernel crash impact). The score appropriately captures the local-only nature while reflecting significant availability impact. Organizations with stacked LSM security models may consider this more critical than the base score suggests.

Frequently asked questions