CVE-2026-46302: Linux SELinux Policy File Lock Denial-of-Service Vulnerability

Technical summary

CVE-2026-46302 addresses a concurrency control flaw in the SELinux subsystem's policy interface at /sys/fs/selinux/policy. The kernel previously enforced a single-open-at-a-time restriction via a policy_opened flag, causing subsequent open attempts to block until the file was closed. This creates a trivial denial-of-service vector: any unprivileged local process can open the policy file and hold it indefinitely, starving other processes—including security management tools and audit daemons—of access to the kernel's active SELinux policy. The fix eliminates the policy_opened flag and refines mutex scoping, allowing multiple concurrent readers while protecting against unbounded memory allocation through alternative mechanisms.

Business impact

Organizations relying on SELinux for mandatory access control enforcement face operational disruption if unprivileged users can block policy introspection. Security monitoring tools, policy auditing software, and compliance verification utilities may fail silently or timeout when unable to read the active policy. In environments where SELinux policies are dynamically managed or frequently validated, this vulnerability can degrade defensive posture by preventing real-time policy verification and potentially masking unauthorized policy changes. The impact is particularly acute in containerized and multi-tenant systems where workload isolation depends on SELinux enforcement validation.

Affected systems

The vulnerability affects Linux kernel systems with SELinux enabled and accessible through the unprivileged /sys/fs/selinux/policy interface. This includes RHEL, CentOS, Ubuntu, Debian, and other distributions shipping SELinux-enabled kernels. Affected versions span the kernel mainline until resolution. Systems without SELinux compiled or enabled are unaffected. The vulnerability is exploitable by any local user account (UID > 0) with access to the filesystem.

Exploitability

Exploitation requires only local access and the ability to open a file, making it trivial to execute. No special privileges, kernel knowledge, or race conditions are necessary. An unprivileged process executing `open("/sys/fs/selinux/policy", O_RDONLY)` and holding the file descriptor will immediately block all other readers. The attack is completely reliable and can be sustained indefinitely or triggered repeatedly to cause transient denial-of-service against dependent applications. CVSS 5.5 reflects local-only access and availability impact without confidentiality or integrity compromise.

Remediation

Remediation requires patching the Linux kernel to incorporate the fix that removes the policy_opened flag and refines policy mutex scoping. Systems should be updated to kernel versions containing the upstream resolution. Administrators should verify their kernel version against the vendor advisory and plan updates through standard patch management cycles. Until patched, mitigation is limited to restricting filesystem access via LSM policies or strict user account isolation, though these do not fully prevent exploitation by authorized local users.

Patch guidance

Verify your kernel version and distribution against the vendor advisory from your Linux distribution (Red Hat, Canonical, Debian, etc.). The fix resolves the issue by allowing concurrent access to /sys/fs/selinux/policy while maintaining safety through refined locking. Apply kernel updates according to your organization's change management policy. Test in non-production environments to verify SELinux policy auditing tools and security monitoring continue functioning normally post-patch. Restart affected services or systems as required by your distribution's update mechanism.

Detection guidance

Monitor for repeated failed open or read attempts on /sys/fs/selinux/policy from unexpected processes. Audit filesystem access logs for sustained open file descriptors on this path. Track process behavior that prevents policy inspection—such as security tools timing out when attempting policy verification. Implement file access monitoring for /sys/fs/selinux/policy via auditd rules: `auditd -w /sys/fs/selinux/policy -p r`. Alert on sequences of concurrent reader failures or permission denied errors when legitimate processes attempt policy access. In containerized environments, monitor for suspicious process activity within workloads targeting filesystem objects in /sys/fs/selinux/.

Why prioritize this

This vulnerability should be prioritized moderately-to-high in SELinux-dependent environments. While exploitability is trivial and requires only local access, the impact on security operations is direct: blocking policy introspection prevents validation of security controls and can mask malicious SELinux policy modifications. Organizations using SELinux for container isolation, multi-tenant enforcement, or compliance-critical access control should prioritize patching. Conversely, systems where SELinux is optional or infrequently accessed can defer patching to standard maintenance windows.

Risk score, explained

The CVSS 5.5 MEDIUM severity reflects a local attack vector (AV:L) with low complexity (AC:L), unprivileged access (PR:L), no user interaction (UI:N), and unchanged scope (S:U). The score captures high availability impact (A:H) from denial-of-service, while acknowledging no direct confidentiality or integrity breach. The score appropriately underweights the operational risk in security-critical deployments; context-specific risk assessments should consider reliance on SELinux policy auditability and the ease of sustained exploitation.

Frequently asked questions