CVE-2026-46104 Overview
CVE-2026-46104 affects the Linux kernel's SELinux subsystem. The vulnerability resides in socket permission helpers that directly dereference sk->sk_security instead of using the proper composite Linux Security Module (LSM) blob accessor. This direct access assumes the SELinux socket blob lives at offset zero within the composite blob.
In stacked LSM configurations, that assumption breaks. When another LSM allocates socket blob storage before SELinux, the helpers sock_has_perm() and nlmsg_sock_has_extended_perms() read the wrong blob. The result is invalid Security Identifier (SID) and class values being passed into Access Vector Cache (AVC) checks, undermining SELinux access control decisions.
Critical Impact
Incorrect SELinux access control decisions on stacked LSM kernels may allow socket operations to bypass intended mandatory access control policies.
Affected Products
- Linux kernel SELinux subsystem in stacked LSM configurations
- Kernel builds where another LSM allocates socket blob storage before SELinux
- Distributions shipping affected upstream kernel versions prior to the referenced fix commits
Discovery Timeline
- 2026-05-28 - CVE-2026-46104 published to the National Vulnerability Database (NVD)
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-46104
Vulnerability Analysis
The Linux Security Module framework allows multiple LSMs to coexist through a composite blob model. Each LSM reserves a region within a shared blob attached to kernel objects such as sockets. SELinux stores its per-socket state inside this composite socket blob.
The correct way to retrieve SELinux's per-socket state is through the selinux_sock() accessor. This helper applies the SELinux-specific offset within the composite blob. Two SELinux helpers, sock_has_perm() and nlmsg_sock_has_extended_perms(), instead dereferenced sk->sk_security directly. That pointer references the start of the composite blob, not necessarily SELinux's region.
When SELinux is the only socket-blob owner, both approaches yield the same address. When another LSM registers socket blob storage first, the SELinux region shifts to a non-zero offset. The direct dereference then returns memory belonging to a different LSM, interpreted as a SELinux socket security structure.
Root Cause
The root cause is an incorrect assumption about blob layout in the LSM stacking model. The helpers treated sk->sk_security as a SELinux-private pointer rather than the start of a shared composite blob. This is a kernel access-control logic flaw rather than a memory corruption issue.
Attack Vector
Exploitation requires a kernel built with stacked LSMs where another module registers socket blob storage ahead of SELinux. On such systems, socket-related permission checks may operate on attacker-influenced or unrelated bytes interpreted as SID and security class. The result is non-deterministic AVC decisions that can permit or deny socket operations against policy.
The upstream fix replaces direct sk->sk_security dereferences with calls to selinux_sock(), ensuring helpers always read from the correct SELinux blob region. See the referenced kernel commits 032e70aff025, 7eca71f57f19, and d350fef4bc24 for the patches.
Detection Methods for CVE-2026-46104
Indicators of Compromise
- Unexpected SELinux AVC denials or grants on socket and netlink operations that do not match the loaded policy
- Audit log entries referencing unfamiliar SID or class values for socket-related permission checks
- Inconsistent enforcement results across reboots on kernels with multiple active LSMs
Detection Strategies
- Inventory kernel versions and confirm whether builds include the fix commits referenced in the kernel.org advisory
- Review the active LSM stack via /sys/kernel/security/lsm and identify any module that allocates socket blob storage ahead of SELinux
- Correlate auditd records with policy expectations to surface anomalous socket permission decisions
Monitoring Recommendations
- Forward auditd SELinux events to a centralized analytics platform for policy-deviation analysis
- Track kernel package versions across the fleet and alert on hosts running unpatched builds
- Monitor netlink socket activity from non-privileged processes for unexpected success against restricted operations
How to Mitigate CVE-2026-46104
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the kernel.org commit links and reboot affected hosts
- Update to a distribution kernel package that incorporates the SELinux socket blob accessor fix
- Audit the active LSM configuration on systems running stacked LSMs to identify exposure
Patch Information
The fix replaces direct sk->sk_security access with selinux_sock() in sock_has_perm() and nlmsg_sock_has_extended_perms(). The corrected helpers resolve the SELinux blob through the LSM framework's offset accounting. Patches are available in upstream kernel commits 032e70aff025, 7eca71f57f19, and d350fef4bc24.
Workarounds
- Where patching is not immediately possible, boot with only SELinux enabled in the LSM stack to avoid the offset mismatch condition
- Restrict local user access on multi-LSM kernels until the fix is applied, reducing the attack surface for socket-based policy bypass
- Validate SELinux policy enforcement after kernel updates using policy regression tests covering socket and netlink classes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
