CVE-2026-46328

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46328", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.112Z", "datePublished": "2026-06-09T12:25:57.629Z", "dateUpdated": "2026-08-05T12:31:23.796Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:31:23.796Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix rlimit for posix cpu timers\n\nPosix cpu timers requires an additional step beyond setting the rlimit.\nRefactor the code so its clear when what code is setting the\nlimit and conditionally update the posix cpu timers when appropriate."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H", "baseScore": 7.3, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is only reached via the execve() credential-commit path (security_bprm_committing_creds \u2192 apparmor_bprm_committing_creds \u2192 __aa_transition_rlimits), requiring a local syscall with no network-facing entry point.\nAC:L - An attacker who can exec between AppArmor profiles with differing RLIMIT_CPU rules controls both the transition timing and CPU consumption beforehand, making the stale posix_cputimers.nextevt condition reliably triggerable whenever policy permits the exec.\nPR:L - Exploitation requires only an unprivileged local process already confined by AppArmor that is permitted to exec into a different profile; no real root or capabilities beyond what the AppArmor policy already grants are needed.\nUI:N - No victim interaction is required; the attacker triggers the bug by executing a binary that causes an AppArmor profile transition on their own process.\nS:C - The bug breaches the AppArmor MAC security boundary by allowing a confined process to exceed administrator-defined RLIMIT_CPU constraints that policy intended to enforce, impacting host resources beyond what the profile permits.\nC:N - The flaw desynchronizes a timer expiration cache from rlimit values; it does not read kernel memory, leak pointers, or provide any information disclosure primitive.\nI:L - While not arbitrary memory write, bypassing AppArmor-enforced CPU hard limits is a limited but real integrity failure of the security policy\u2019s resource enforcement, allowing a confined process to exceed mandated constraints.\nA:H - A stale high nextevt lets confined workloads exceed CPU caps and exhaust CPU on shared Ubuntu/cloud hosts, and a stale low nextevt can deliver premature SIGXCPU that terminates confined services; both constitute high availability impact even without a kernel panic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["security/apparmor/resource.c"], "versions": [{"version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21", "lessThan": "e1cc11550b2f66687a374536c9dfdddcefca0efe", "status": "affected", "versionType": "git"}, {"version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21", "lessThan": "2232d7cd243833ad750cae656d1817fe43744a09", "status": "affected", "versionType": "git"}, {"version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21", "lessThan": "28aa93fcfb33b6d580c5df4ae8b6d13fb0e6fcd3", "status": "affected", "versionType": "git"}, {"version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21", "lessThan": "1f736dfe27c857b78f8461cd7c3dd9640be74b37", "status": "affected", "versionType": "git"}, {"version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21", "lessThan": "e43818b16815c0c2bf933ef28316f8e704e5e0ef", "status": "affected", "versionType": "git"}, {"version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21", "lessThan": "9bf1fa150775b0c6b794e4b6a2c0395e13777999", "status": "affected", "versionType": "git"}, {"version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21", "lessThan": "57d51d41b90eface809b72e0e009b50546492f1f", "status": "affected", "versionType": "git"}, {"version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21", "lessThan": "6ca56813f4a589f536adceb42882855d91fb1125", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["security/apparmor/resource.c"], "versions": [{"version": "4.10", "status": "affected"}, {"version": "0", "lessThan": "4.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.252", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.202", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.165", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.128", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.75", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.14", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.4", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "5.10.252"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "5.15.202"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.1.165"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.6.128"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.12.75"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.18.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.19.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e1cc11550b2f66687a374536c9dfdddcefca0efe"}, {"url": "https://git.kernel.org/stable/c/2232d7cd243833ad750cae656d1817fe43744a09"}, {"url": "https://git.kernel.org/stable/c/28aa93fcfb33b6d580c5df4ae8b6d13fb0e6fcd3"}, {"url": "https://git.kernel.org/stable/c/1f736dfe27c857b78f8461cd7c3dd9640be74b37"}, {"url": "https://git.kernel.org/stable/c/e43818b16815c0c2bf933ef28316f8e704e5e0ef"}, {"url": "https://git.kernel.org/stable/c/9bf1fa150775b0c6b794e4b6a2c0395e13777999"}, {"url": "https://git.kernel.org/stable/c/57d51d41b90eface809b72e0e009b50546492f1f"}, {"url": "https://git.kernel.org/stable/c/6ca56813f4a589f536adceb42882855d91fb1125"}], "title": "apparmor: fix rlimit for posix cpu timers", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["security/apparmor/resource.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e1cc11550b2f66687a374536c9dfdddcefca0efe", "status": "affected", "version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21", "versionType": "git"}, {"lessThan": "2232d7cd243833ad750cae656d1817fe43744a09", "status": "affected", "version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21", "versionType": "git"}, {"lessThan": "28aa93fcfb33b6d580c5df4ae8b6d13fb0e6fcd3", "status": "affected", "version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21", "versionType": "git"}, {"lessThan": "1f736dfe27c857b78f8461cd7c3dd9640be74b37", "status": "affected", "version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21", "versionType": "git"}, {"lessThan": "e43818b16815c0c2bf933ef28316f8e704e5e0ef", "status": "affected", "version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21", "versionType": "git"}, {"lessThan": "9bf1fa150775b0c6b794e4b6a2c0395e13777999", "status": "affected", "version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21", "versionType": "git"}, {"lessThan": "57d51d41b90eface809b72e0e009b50546492f1f", "status": "affected", "version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21", "versionType": "git"}, {"lessThan": "6ca56813f4a589f536adceb42882855d91fb1125", "status": "affected", "version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["security/apparmor/resource.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.10"}, {"lessThan": "4.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.252", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.202", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.165", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.128", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.75", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.14", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6237C80F-2950-41ED-A424-2872192E5F12", "versionEndExcluding": "5.10.252", "versionStartIncluding": "4.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4002FC2B-1456-4666-B240-0EBF590C4671", "versionEndExcluding": "5.15.202", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "797C7F46-D0BE-4FB8-A502-C5EF8E6B6654", "versionEndExcluding": "6.1.165", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "851E9353-6C09-4CC9-877E-E09DB164A3C2", "versionEndExcluding": "6.6.128", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BCE16369-98ED-41CF-8995-DFDC10B288D2", "versionEndExcluding": "6.12.75", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF463CB7-1F58-4607-B847-77ED23E4B9B7", "versionEndExcluding": "6.18.14", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "672A3E79-EC03-479D-8503-361DFBDC8092", "versionEndExcluding": "6.19.4", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix rlimit for posix cpu timers\n\nPosix cpu timers requires an additional step beyond setting the rlimit.\nRefactor the code so its clear when what code is setting the\nlimit and conditionally update the posix cpu timers when appropriate."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\napparmor: corregir rlimit para los temporizadores de CPU posix\n\nLos temporizadores de CPU posix requieren un paso adicional m\u00e1s all\u00e1 de establecer el rlimit.\nRefactorizar el c\u00f3digo para que quede claro cu\u00e1ndo qu\u00e9 c\u00f3digo est\u00e1 estableciendo el l\u00edmite y actualizar condicionalmente los temporizadores de CPU posix cuando sea apropiado."}], "id": "CVE-2026-46328", "lastModified": "2026-07-23T08:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 4.7, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-06-09T14:16:42.500", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1f736dfe27c857b78f8461cd7c3dd9640be74b37"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2232d7cd243833ad750cae656d1817fe43744a09"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/28aa93fcfb33b6d580c5df4ae8b6d13fb0e6fcd3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/57d51d41b90eface809b72e0e009b50546492f1f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6ca56813f4a589f536adceb42882855d91fb1125"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9bf1fa150775b0c6b794e4b6a2c0395e13777999"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e1cc11550b2f66687a374536c9dfdddcefca0efe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e43818b16815c0c2bf933ef28316f8e704e5e0ef"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: apparmor: fix rlimit for posix cpu timers", "id": "2487000", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487000"}, "csaw": false, "cwe": "CWE-770", "details": ["A flaw was found in the Linux kernel's AppArmor security module. The system's rlimit (resource limit) for POSIX (Portable Operating System Interface) CPU timers was not correctly enforced. This issue, stemming from an overlooked step in applying resource limits, could allow a local attacker to bypass intended CPU time restrictions, potentially leading to excessive resource consumption or a denial of service."], "name": "CVE-2026-46328", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46328\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46328\nhttps://lore.kernel.org/linux-cve-announce/2026060910-CVE-2026-46328-dc30@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baa73d9e478ff32d62f3f9422822b59dd9a95a21,e1cc11550b2f66687a374536c9dfdddcefca0efe)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baa73d9e478ff32d62f3f9422822b59dd9a95a21,2232d7cd243833ad750cae656d1817fe43744a09)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baa73d9e478ff32d62f3f9422822b59dd9a95a21,28aa93fcfb33b6d580c5df4ae8b6d13fb0e6fcd3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baa73d9e478ff32d62f3f9422822b59dd9a95a21,1f736dfe27c857b78f8461cd7c3dd9640be74b37)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baa73d9e478ff32d62f3f9422822b59dd9a95a21,e43818b16815c0c2bf933ef28316f8e704e5e0ef)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baa73d9e478ff32d62f3f9422822b59dd9a95a21,9bf1fa150775b0c6b794e4b6a2c0395e13777999)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baa73d9e478ff32d62f3f9422822b59dd9a95a21,57d51d41b90eface809b72e0e009b50546492f1f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[baa73d9e478ff32d62f3f9422822b59dd9a95a21,6ca56813f4a589f536adceb42882855d91fb1125)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.252,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.202,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.165,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.128,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.75,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.14,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.4,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-09T15:30:07.779487+00:00", "updated": "2026-08-13T20:30:02.614524+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}