CVE-2026-46150

Summary

In the Linux kernel, the following vulnerability has been resolved:

fanotify: fix false positive on permission events

fsnotify_get_mark_safe() may return false for a mark on an unrelated group, which results in bypassing the permission check.

Fix by skipping over detached marks that are not in the current group.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxabc77577a669f424c5d0c185b9994f2621c52aa4 < a24765332e129c1916d5a6615418b75599b8fcdcaffected
LinuxLinuxabc77577a669f424c5d0c185b9994f2621c52aa4 < 4a7611ad653785fcdea5ff5f4441e2b7d05b7f11affected
LinuxLinuxabc77577a669f424c5d0c185b9994f2621c52aa4 < 04bb66be92f48ed13c3faf1139d892df228789bcaffected
LinuxLinuxabc77577a669f424c5d0c185b9994f2621c52aa4 < 895ebbedf88318607c24acc0f591c74b165e1d0aaffected
LinuxLinuxabc77577a669f424c5d0c185b9994f2621c52aa4 < f130790f1acc8399f32652846c875a251efd040faffected
LinuxLinuxabc77577a669f424c5d0c185b9994f2621c52aa4 < 7baa02b0ae9d17ec5f08836d8ea88ce1927d0678affected
LinuxLinuxabc77577a669f424c5d0c185b9994f2621c52aa4 < b7b24b28c8cd55844cab908f4f39dded638d5538affected
LinuxLinuxabc77577a669f424c5d0c185b9994f2621c52aa4 < 7746e3bd4cc19b5092e00d32d676e329bfcb6900affected
LinuxLinux4.12affected
LinuxLinux0 < 4.12unaffected
LinuxLinux5.10.258 <= 5.10.*unaffected
LinuxLinux5.15.209 <= 5.15.*unaffected
LinuxLinux6.1.175 <= 6.1.*unaffected
LinuxLinux6.6.140 <= 6.6.*unaffected
LinuxLinux6.12.88 <= 6.12.*unaffected
LinuxLinux6.18.30 <= 6.18.*unaffected
LinuxLinux7.0.7 <= 7.0.*unaffected
LinuxLinux7.1 <= *unaffected

Weaknesses

References