CVE-2026-46328 (GCVE-0-2026-46328)
Vulnerability from cvelistv5
Published
2026-06-09 12:25
Modified
2026-08-05 12:31
Severity ?
7.3 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix rlimit for posix cpu timers Posix cpu timers requires an additional step beyond setting the rlimit. Refactor the code so its clear when what code is setting the limit and conditionally update the posix cpu timers when appropriate.
References
Impacted products
Vendor Product Version
Linux Linux Version: baa73d9e478ff32d62f3f9422822b59dd9a95a21
Version: baa73d9e478ff32d62f3f9422822b59dd9a95a21
Version: baa73d9e478ff32d62f3f9422822b59dd9a95a21
Version: baa73d9e478ff32d62f3f9422822b59dd9a95a21
Version: baa73d9e478ff32d62f3f9422822b59dd9a95a21
Version: baa73d9e478ff32d62f3f9422822b59dd9a95a21
Version: baa73d9e478ff32d62f3f9422822b59dd9a95a21
Version: baa73d9e478ff32d62f3f9422822b59dd9a95a21
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/resource.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e1cc11550b2f66687a374536c9dfdddcefca0efe",
              "status": "affected",
              "version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21",
              "versionType": "git"
            },
            {
              "lessThan": "2232d7cd243833ad750cae656d1817fe43744a09",
              "status": "affected",
              "version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21",
              "versionType": "git"
            },
            {
              "lessThan": "28aa93fcfb33b6d580c5df4ae8b6d13fb0e6fcd3",
              "status": "affected",
              "version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21",
              "versionType": "git"
            },
            {
              "lessThan": "1f736dfe27c857b78f8461cd7c3dd9640be74b37",
              "status": "affected",
              "version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21",
              "versionType": "git"
            },
            {
              "lessThan": "e43818b16815c0c2bf933ef28316f8e704e5e0ef",
              "status": "affected",
              "version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21",
              "versionType": "git"
            },
            {
              "lessThan": "9bf1fa150775b0c6b794e4b6a2c0395e13777999",
              "status": "affected",
              "version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21",
              "versionType": "git"
            },
            {
              "lessThan": "57d51d41b90eface809b72e0e009b50546492f1f",
              "status": "affected",
              "version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21",
              "versionType": "git"
            },
            {
              "lessThan": "6ca56813f4a589f536adceb42882855d91fb1125",
              "status": "affected",
              "version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/apparmor/resource.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.10"
            },
            {
              "lessThan": "4.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix rlimit for posix cpu timers\n\nPosix cpu timers requires an additional step beyond setting the rlimit.\nRefactor the code so its clear when what code is setting the\nlimit and conditionally update the posix cpu timers when appropriate."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is only reached via the execve() credential-commit path (security_bprm_committing_creds \u2192 apparmor_bprm_committing_creds \u2192 __aa_transition_rlimits), requiring a local syscall with no network-facing entry point.\nAC:L - An attacker who can exec between AppArmor profiles with differing RLIMIT_CPU rules controls both the transition timing and CPU consumption beforehand, making the stale posix_cputimers.nextevt condition reliably triggerable whenever policy permits the exec.\nPR:L - Exploitation requires only an unprivileged local process already confined by AppArmor that is permitted to exec into a different profile; no real root or capabilities beyond what the AppArmor policy already grants are needed.\nUI:N - No victim interaction is required; the attacker triggers the bug by executing a binary that causes an AppArmor profile transition on their own process.\nS:C - The bug breaches the AppArmor MAC security boundary by allowing a confined process to exceed administrator-defined RLIMIT_CPU constraints that policy intended to enforce, impacting host resources beyond what the profile permits.\nC:N - The flaw desynchronizes a timer expiration cache from rlimit values; it does not read kernel memory, leak pointers, or provide any information disclosure primitive.\nI:L - While not arbitrary memory write, bypassing AppArmor-enforced CPU hard limits is a limited but real integrity failure of the security policy\u2019s resource enforcement, allowing a confined process to exceed mandated constraints.\nA:H - A stale high nextevt lets confined workloads exceed CPU caps and exhaust CPU on shared Ubuntu/cloud hosts, and a stale low nextevt can deliver premature SIGXCPU that terminates confined services; both constitute high availability impact even without a kernel panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:23.796Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e1cc11550b2f66687a374536c9dfdddcefca0efe"
        },
        {
          "url": "https://git.kernel.org/stable/c/2232d7cd243833ad750cae656d1817fe43744a09"
        },
        {
          "url": "https://git.kernel.org/stable/c/28aa93fcfb33b6d580c5df4ae8b6d13fb0e6fcd3"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f736dfe27c857b78f8461cd7c3dd9640be74b37"
        },
        {
          "url": "https://git.kernel.org/stable/c/e43818b16815c0c2bf933ef28316f8e704e5e0ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/9bf1fa150775b0c6b794e4b6a2c0395e13777999"
        },
        {
          "url": "https://git.kernel.org/stable/c/57d51d41b90eface809b72e0e009b50546492f1f"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ca56813f4a589f536adceb42882855d91fb1125"
        }
      ],
      "title": "apparmor: fix rlimit for posix cpu timers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46328",
    "datePublished": "2026-06-09T12:25:57.629Z",
    "dateReserved": "2026-05-13T15:03:33.112Z",
    "dateUpdated": "2026-08-05T12:31:23.796Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.