Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-46150

fanotify: fix false positive on permission events

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.88, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: fanotify: fix false positive on permission events fsnotify_get_mark_safe() may return false for a mark on an unrelated group, which results in bypassing the permission check. Fix by skipping over detached marks that are not in the current group.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From abc77577a669f424c5d0c185b9994f2621c52aa4 · fixed in a24765332e129c1916d5a6615418b75599b8fcdc; From abc77577a669f424c5d0c185b9994f2621c52aa4 · fixed in 4a7611ad653785fcdea5ff5f4441e2b7d05b7f11; From abc77577a669f424c5d0c185b9994f2621c52aa4 · fixed in 04bb66be92f48ed13c3faf1139d892df228789bc; From abc77577a669f424c5d0c185b9994f2621c52aa4 · fixed in 895ebbedf88318607c24acc0f591c74b165e1d0a; From abc77577a669f424c5d0c185b9994f2621c52aa4 · fixed in f130790f1acc8399f32652846c875a251efd040f; From abc77577a669f424c5d0c185b9994f2621c52aa4 · fixed in 7baa02b0ae9d17ec5f08836d8ea88ce1927d0678; From abc77577a669f424c5d0c185b9994f2621c52aa4 · fixed in b7b24b28c8cd55844cab908f4f39dded638d5538; From abc77577a669f424c5d0c185b9994f2621c52aa4 · fixed in 7746e3bd4cc19b5092e00d32d676e329bfcb6900

  • Linux Linux

    4.12

  • KernelLinux

    From 4.12.0 · fixed in 5.10.258; From 5.11.0 · fixed in 5.15.209; From 5.16.0 · fixed in 6.1.175; From 6.2.0 · fixed in 6.6.140; From 6.7.0 · fixed in 6.12.88; From 6.13.0 · fixed in 6.18.30; From 6.19.0 · fixed in 7.0.7

References 8

git.kernel.org