| { |
| "containers": { |
| "cna": { |
| "providerMetadata": { |
| "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" |
| }, |
| "descriptions": [ |
| { |
| "lang": "en", |
| "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfanotify: fix false positive on permission events\n\nfsnotify_get_mark_safe() may return false for a mark on an unrelated group,\nwhich results in bypassing the permission check.\n\nFix by skipping over detached marks that are not in the current group." |
| } |
| ], |
| "metrics": [ |
| { |
| "cvssV3_1": { |
| "version": "3.1", |
| "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", |
| "baseScore": 7.1, |
| "baseSeverity": "HIGH" |
| }, |
| "scenarios": [ |
| { |
| "lang": "en", |
| "value": "AV:L - The vulnerable code runs in the context of a local file operation (open/read/exec) that triggers the fanotify permission event; the attacker bypasses the control by performing local file ops plus churning a local inotify watch. The fully-controllable, reliable attack is local (a remote file-server scenario would lose attacker control of the race).\nAC:L - The attacker controls both sides of the race — the lifecycle of the unrelated (unprivileged inotify) mark and the retried file operation — and each open() is a fresh permission event, so with unlimited retries the bypass is reliably reachable.\nPR:L - Exploitation only needs an unprivileged local account: creating an inotify watch on the parent directory and opening/executing the target file require no capabilities (the privileged CAP_SYS_ADMIN fanotify group is the victim control, not the attacker).\nUI:N - The attacker performs all actions (inotify churn plus repeated file access) with no interaction from any other user.\nS:U - The flaw and its impact are both mediated entirely within the kernel's own access-control path; no boundary to a separately-managed security authority (VM, IOMMU) is crossed.\nC:H - Bypassing FAN_ACCESS_PERM/FAN_OPEN_PERM lets read access to files the policy (AV/sandbox/EDR) would deny proceed; via targeted retries the attacker can force disclosure of chosen protected files, approaching total loss of confidentiality of protected resources.\nI:H - Bypassing FAN_OPEN_PERM/FAN_OPEN_EXEC_PERM lets writes to protected files and execution of binaries the policy would block proceed, allowing modification of protected resources and execution of disallowed code.\nA:N - The bug is fail-open (it only allows operations that should be blocked); it causes no crash, hang, or resource exhaustion, so availability is unaffected." |
| } |
| ] |
| } |
| ], |
| "affected": [ |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "unaffected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "fs/notify/fsnotify.c", |
| "fs/notify/mark.c", |
| "include/linux/fsnotify_backend.h" |
| ], |
| "versions": [ |
| { |
| "version": "abc77577a669f424c5d0c185b9994f2621c52aa4", |
| "lessThan": "a24765332e129c1916d5a6615418b75599b8fcdc", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "abc77577a669f424c5d0c185b9994f2621c52aa4", |
| "lessThan": "4a7611ad653785fcdea5ff5f4441e2b7d05b7f11", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "abc77577a669f424c5d0c185b9994f2621c52aa4", |
| "lessThan": "04bb66be92f48ed13c3faf1139d892df228789bc", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "abc77577a669f424c5d0c185b9994f2621c52aa4", |
| "lessThan": "895ebbedf88318607c24acc0f591c74b165e1d0a", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "abc77577a669f424c5d0c185b9994f2621c52aa4", |
| "lessThan": "f130790f1acc8399f32652846c875a251efd040f", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "abc77577a669f424c5d0c185b9994f2621c52aa4", |
| "lessThan": "7baa02b0ae9d17ec5f08836d8ea88ce1927d0678", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "abc77577a669f424c5d0c185b9994f2621c52aa4", |
| "lessThan": "b7b24b28c8cd55844cab908f4f39dded638d5538", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "abc77577a669f424c5d0c185b9994f2621c52aa4", |
| "lessThan": "7746e3bd4cc19b5092e00d32d676e329bfcb6900", |
| "status": "affected", |
| "versionType": "git" |
| } |
| ] |
| }, |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "affected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "fs/notify/fsnotify.c", |
| "fs/notify/mark.c", |
| "include/linux/fsnotify_backend.h" |
| ], |
| "versions": [ |
| { |
| "version": "4.12", |
| "status": "affected" |
| }, |
| { |
| "version": "0", |
| "lessThan": "4.12", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "5.10.258", |
| "lessThanOrEqual": "5.10.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "5.15.209", |
| "lessThanOrEqual": "5.15.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.1.175", |
| "lessThanOrEqual": "6.1.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.6.140", |
| "lessThanOrEqual": "6.6.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.12.88", |
| "lessThanOrEqual": "6.12.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.18.30", |
| "lessThanOrEqual": "6.18.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "7.0.7", |
| "lessThanOrEqual": "7.0.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "7.1", |
| "lessThanOrEqual": "*", |
| "status": "unaffected", |
| "versionType": "original_commit_for_fix" |
| } |
| ] |
| } |
| ], |
| "cpeApplicability": [ |
| { |
| "nodes": [ |
| { |
| "operator": "OR", |
| "negate": false, |
| "cpeMatch": [ |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "4.12", |
| "versionEndExcluding": "5.10.258" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "4.12", |
| "versionEndExcluding": "5.15.209" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "4.12", |
| "versionEndExcluding": "6.1.175" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "4.12", |
| "versionEndExcluding": "6.6.140" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "4.12", |
| "versionEndExcluding": "6.12.88" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "4.12", |
| "versionEndExcluding": "6.18.30" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "4.12", |
| "versionEndExcluding": "7.0.7" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "4.12", |
| "versionEndExcluding": "7.1" |
| } |
| ] |
| } |
| ] |
| } |
| ], |
| "references": [ |
| { |
| "url": "https://git.kernel.org/stable/c/a24765332e129c1916d5a6615418b75599b8fcdc" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/4a7611ad653785fcdea5ff5f4441e2b7d05b7f11" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/04bb66be92f48ed13c3faf1139d892df228789bc" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/895ebbedf88318607c24acc0f591c74b165e1d0a" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/f130790f1acc8399f32652846c875a251efd040f" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/7baa02b0ae9d17ec5f08836d8ea88ce1927d0678" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/b7b24b28c8cd55844cab908f4f39dded638d5538" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/7746e3bd4cc19b5092e00d32d676e329bfcb6900" |
| } |
| ], |
| "title": "fanotify: fix false positive on permission events", |
| "x_generator": { |
| "engine": "bippy-1.2.0" |
| } |
| } |
| }, |
| "cveMetadata": { |
| "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", |
| "cveId": "CVE-2026-46150", |
| "state": "PUBLISHED" |
| }, |
| "dataType": "CVE_RECORD", |
| "dataVersion": "5.1.1" |
| } |
