CVE-2026-46333: ptrace: slightly saner 'get_dumpable()' logic

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• debian debian linux11.0
• linux linux kernel4.4.40 and later · before 4.5
• linux linux kernel4.8.16 and later · before 4.9
• linux linux kernel4.9.1 and later · before 5.10.256
• linux linux kernel5.11 and later · before 5.15.207
• linux linux kernel5.16 and later · before 6.1.173
• linux linux kernel3.16.52 and later · before 3.17
• linux linux kernel6.7 and later · before 6.12.89
• linux linux kernel6.13 and later · before 6.18.31
• linux linux kernel6.19 and later · before 7.0.8
• linux linux kernel6.2 and later · before 6.6.139
• linux linux kernel7.1

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • 694a95fa6dae4991f16cda333d897ea063021fed, 4.10, d5b3e840dbf6dd2c0f30b5982b6f5ecd49e46b12, 03eed7afbc09e061f66b448daf7863174c3dc3f3, e45692fa1aea06676449b63ef3c2b6e1e72b7578affected
  • 3.16.52 and later · before 3.17affected · semver
  • 4.4.40 and later · before 4.5affected · semver
  • 4.8.16 and later · before 4.9affected · semver
  • 4.9.1 and later · before 4.10affected · semver
  • before 4.10not affected · semver
  • 5.10.256 and later · up to and including 5.10.*not affected · semver
  • 5.15.207 and later · up to and including 5.15.*not affected · semver
  • 6.1.173 and later · up to and including 6.1.*not affected · semver
  • 6.6.139 and later · up to and including 6.6.*not affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2026-43488May 13, 2026 · usb: xhci: Prevent interrupt storm on host controller error (HCE)
  22Monitor
• ← EarlierCVE-2026-43490May 15, 2026 · ksmbd: validate inherited ACE SID length
  35Monitor
• Later →CVE-2026-43491May 19, 2026 · net: qrtr: ns: Limit the maximum server registration per node
  22Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

To simplify setup, a service account is granted broad, cluster-wide permissions. The principle of least privilege is skipped during installation.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1kind: ClusterRole2rules:3  - apiGroups: ["*"]4    resources: ["*"]5    verbs: ["*"]

1kind: Role2metadata:3  namespace: lodos-system4rules:5  - apiGroups: ["apps"]6    resources: ["deployments"]7    verbs: ["get", "list", "update"]

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.