CVE-2026-46150
fanotify Permission Check Bypass in Linux Kernel
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux_kernel | linux_kernel | * |
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's fanotify subsystem. The function fsnotify_get_mark_safe() may incorrectly return false for a mark that belongs to an unrelated group. This causes the system to bypass permission checks that should normally be enforced.
The issue is fixed by modifying the code to skip over detached marks that are not part of the current group, preventing false positives on permission events.
How can this vulnerability impact me? :
Because the vulnerability allows permission checks to be bypassed, it could potentially let unauthorized users or processes access files or resources they should not have permission to access.
This could lead to unauthorized data access or modification, compromising system security and data integrity.