{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-46328","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-05-13T15:03:33.112Z","datePublished":"2026-06-09T12:25:57.629Z","dateUpdated":"2026-08-05T12:31:23.796Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:31:23.796Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix rlimit for posix cpu timers\n\nPosix cpu timers requires an additional step beyond setting the rlimit.\nRefactor the code so its clear when what code is setting the\nlimit and conditionally update the posix cpu timers when appropriate."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","baseScore":7.3,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is only reached via the execve() credential-commit path (security_bprm_committing_creds → apparmor_bprm_committing_creds → __aa_transition_rlimits), requiring a local syscall with no network-facing entry point.\nAC:L - An attacker who can exec between AppArmor profiles with differing RLIMIT_CPU rules controls both the transition timing and CPU consumption beforehand, making the stale posix_cputimers.nextevt condition reliably triggerable whenever policy permits the exec.\nPR:L - Exploitation requires only an unprivileged local process already confined by AppArmor that is permitted to exec into a different profile; no real root or capabilities beyond what the AppArmor policy already grants are needed.\nUI:N - No victim interaction is required; the attacker triggers the bug by executing a binary that causes an AppArmor profile transition on their own process.\nS:C - The bug breaches the AppArmor MAC security boundary by allowing a confined process to exceed administrator-defined RLIMIT_CPU constraints that policy intended to enforce, impacting host resources beyond what the profile permits.\nC:N - The flaw desynchronizes a timer expiration cache from rlimit values; it does not read kernel memory, leak pointers, or provide any information disclosure primitive.\nI:L - While not arbitrary memory write, bypassing AppArmor-enforced CPU hard limits is a limited but real integrity failure of the security policy’s resource enforcement, allowing a confined process to exceed mandated constraints.\nA:H - A stale high nextevt lets confined workloads exceed CPU caps and exhaust CPU on shared Ubuntu/cloud hosts, and a stale low nextevt can deliver premature SIGXCPU that terminates confined services; both constitute high availability impact even without a kernel panic."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["security/apparmor/resource.c"],"versions":[{"version":"baa73d9e478ff32d62f3f9422822b59dd9a95a21","lessThan":"e1cc11550b2f66687a374536c9dfdddcefca0efe","status":"affected","versionType":"git"},{"version":"baa73d9e478ff32d62f3f9422822b59dd9a95a21","lessThan":"2232d7cd243833ad750cae656d1817fe43744a09","status":"affected","versionType":"git"},{"version":"baa73d9e478ff32d62f3f9422822b59dd9a95a21","lessThan":"28aa93fcfb33b6d580c5df4ae8b6d13fb0e6fcd3","status":"affected","versionType":"git"},{"version":"baa73d9e478ff32d62f3f9422822b59dd9a95a21","lessThan":"1f736dfe27c857b78f8461cd7c3dd9640be74b37","status":"affected","versionType":"git"},{"version":"baa73d9e478ff32d62f3f9422822b59dd9a95a21","lessThan":"e43818b16815c0c2bf933ef28316f8e704e5e0ef","status":"affected","versionType":"git"},{"version":"baa73d9e478ff32d62f3f9422822b59dd9a95a21","lessThan":"9bf1fa150775b0c6b794e4b6a2c0395e13777999","status":"affected","versionType":"git"},{"version":"baa73d9e478ff32d62f3f9422822b59dd9a95a21","lessThan":"57d51d41b90eface809b72e0e009b50546492f1f","status":"affected","versionType":"git"},{"version":"baa73d9e478ff32d62f3f9422822b59dd9a95a21","lessThan":"6ca56813f4a589f536adceb42882855d91fb1125","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["security/apparmor/resource.c"],"versions":[{"version":"4.10","status":"affected"},{"version":"0","lessThan":"4.10","status":"unaffected","versionType":"semver"},{"version":"5.10.252","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.202","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.165","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.128","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.75","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.14","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"6.19.4","lessThanOrEqual":"6.19.*","status":"unaffected","versionType":"semver"},{"version":"7.0","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"5.10.252"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"5.15.202"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.1.165"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.6.128"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.12.75"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.18.14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.19.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"7.0"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/e1cc11550b2f66687a374536c9dfdddcefca0efe"},{"url":"https://git.kernel.org/stable/c/2232d7cd243833ad750cae656d1817fe43744a09"},{"url":"https://git.kernel.org/stable/c/28aa93fcfb33b6d580c5df4ae8b6d13fb0e6fcd3"},{"url":"https://git.kernel.org/stable/c/1f736dfe27c857b78f8461cd7c3dd9640be74b37"},{"url":"https://git.kernel.org/stable/c/e43818b16815c0c2bf933ef28316f8e704e5e0ef"},{"url":"https://git.kernel.org/stable/c/9bf1fa150775b0c6b794e4b6a2c0395e13777999"},{"url":"https://git.kernel.org/stable/c/57d51d41b90eface809b72e0e009b50546492f1f"},{"url":"https://git.kernel.org/stable/c/6ca56813f4a589f536adceb42882855d91fb1125"}],"title":"apparmor: fix rlimit for posix cpu timers","x_generator":{"engine":"bippy-1.2.0"}}}}