CVE-2026-46302: Linux Kernel Privilege Escalation Flaw

CVE-2026-46302 Overview

CVE-2026-46302 is a Linux kernel vulnerability in the Security-Enhanced Linux (SELinux) subsystem. The flaw permits any local process to block other processes from reading the active kernel policy by holding an exclusive open on /sys/fs/selinux/policy. The kernel enforced a single-opener restriction through the policy_opened flag, which serialized access under the SELinux policy mutex. The resolved patch removes that flag, shrinks the critical section guarded by the policy mutex, and drops extraneous BUG_ON assertions. The change allows concurrent readers without exposing inconsistent policy views.

Critical Impact
Any unprivileged local process can monopolize /sys/fs/selinux/policy, denying policy reads to administrators, auditing tools, and security agents that depend on live policy introspection.

Affected Products

Linux kernel versions containing the original SELinux policy_opened serialization logic
Distributions shipping the Linux kernel with SELinux enabled (Red Hat Enterprise Linux, Fedora, CentOS Stream, Ubuntu, Debian, SUSE, and derivatives)
Systems mounting selinuxfs at /sys/fs/selinux in enforcing or permissive mode

Discovery Timeline

2026-06-08 - CVE-2026-46302 published to the National Vulnerability Database
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-46302

Vulnerability Analysis

The SELinux subsystem exposes the running policy through the selinuxfs pseudo-filesystem at /sys/fs/selinux/policy. The original implementation guarded this file with a policy_opened flag, allowing only one open file descriptor at a time. The intent was to prevent userspace from observing a partially updated policy and to limit unbounded kernel memory allocation for policy snapshots.

The single-open semantic creates a denial-of-service primitive. A local user can open the file and hold the descriptor indefinitely, returning -EBUSY to any subsequent opener. Security tooling, audit utilities such as sesearch, and administrative scripts that read the binary policy then fail. The mitigation eliminates the flag and reduces the window during which the policy mutex is held, permitting concurrent readers while maintaining a consistent view.

Root Cause

The root cause is overly broad serialization. The policy_opened flag combined coarse-grained mutual exclusion with the policy mutex, treating policy reads as exclusive operations rather than concurrent snapshots. Holding the descriptor open kept the flag set, which prevented any other process from reaching the policy-read code path.

Attack Vector

The attack vector is local. An attacker with shell access to a SELinux-enabled host runs a process that opens /sys/fs/selinux/policy and does not close the descriptor. Subsequent opens fail until the holder exits. No elevated privileges are required because the file is readable by processes with appropriate SELinux context. The vulnerability does not enable code execution, privilege escalation, or information disclosure beyond what SELinux policy already permits.

No verified public exploit code is associated with this CVE. The mechanism is described in prose because no real exploitation code has been published. See the upstream commits referenced in Kernel Git Commit 714362f3 and Kernel Git Commit a02cd680 for the patch logic.

Detection Methods for CVE-2026-46302

Indicators of Compromise

Processes holding long-lived open file descriptors to /sys/fs/selinux/policy visible in /proc/*/fd/
Repeated EBUSY errors returned to open(2) calls against /sys/fs/selinux/policy in audit logs
Failure of policy-introspection tools such as sesearch, seinfo, or checkpolicy with busy-resource errors

Detection Strategies

Enumerate file descriptors with lsof /sys/fs/selinux/policy on a recurring schedule and alert on any holder retained beyond a short threshold
Audit open syscalls targeting /sys/fs/selinux/policy using auditctl -w /sys/fs/selinux/policy -p r -k selinux_policy_read and review for unexpected callers
Correlate failed policy reads from administrative tooling with concurrent low-privilege processes opening the same path

Monitoring Recommendations

Track kernel and distribution package versions to confirm the patched commits are present on every SELinux host
Alert when non-administrative service accounts access selinuxfs paths outside of expected maintenance windows
Forward Linux audit records to a centralized analytics platform for retention and correlation across the fleet

How to Mitigate CVE-2026-46302

Immediate Actions Required

Apply the upstream Linux kernel patch that removes the policy_opened flag and reboot affected hosts into the patched kernel
Inventory all SELinux-enabled systems and prioritize multi-tenant or shell-accessible hosts for remediation
Restrict interactive shell access on systems where the patched kernel is not yet deployed

Patch Information

The fix is delivered through two upstream commits: 714362f3779dfa453a78ced32396a72726962a41 and a02cd6805562305f936e807da83e253b719dd965. The commits eliminate the single-open restriction on /sys/fs/selinux/policy, narrow the mutex-protected critical section, and remove redundant BUG_ON checks. Distribution maintainers backport these commits into stable kernel series. Apply vendor updates from Red Hat, Canonical, SUSE, or Debian as they become available.

Workarounds

Use SELinux policy to confine untrusted users and services so they cannot reach /sys/fs/selinux/policy reads
Monitor and terminate processes that hold descriptors to /sys/fs/selinux/policy beyond an operational threshold
Schedule policy-reading administrative tasks during windows when interactive user activity is minimal

bash

# Identify processes holding /sys/fs/selinux/policy open
sudo lsof /sys/fs/selinux/policy

# Audit reads of the SELinux policy file
sudo auditctl -w /sys/fs/selinux/policy -p r -k selinux_policy_read
sudo ausearch -k selinux_policy_read

# Verify running kernel version against patched releases
uname -r