Skip to content

CVE-2026-46333 — In the Linux kernel, a vulnerability exists in the ptrace subsystem's get_dumpable()…

Key facts

CVE-2026-46333 (Linux) is a High (7.1) vulnerability: In the Linux kernel, a vulnerability exists in the ptrace subsystem's get_dumpable()…. This entry ships ready-to-deploy detection and prevention rules (Snort, Sigma) plus a detection-only PoC and a Docker test lab.
CVE CVE-2026-46333
Severity High (7.1)
Vendor Linux
Detection / prevention Snort, Sigma
PoC poc.py
Source 2026/CVE-2026-46333/

Details

CVE-2026-46333 (Linux) is a High (7.1) vulnerability: In the Linux kernel, a vulnerability exists in the ptrace subsystem's get_dumpable()…. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort) — see Detection and prevention below. Source: NVD record.

Description

In the Linux kernel, a vulnerability exists in the ptrace subsystem's get_dumpable() logic. The ptrace_may_access() function uses dumpability to check access permissions, but this check is flawed for tasks without an associated mm (memory management) structure, such as kernel threads or tasks that have exited.

When a task has no mm pointer, the dumpability check returns a default value that does not properly enforce capability-based access control. This allows a local attacker with uid-0 (but dropped capabilities) to read sensitive information from kernel threads.

The fix introduces a cached "last dumpability" flag and requires CAP_SYS_PTRACE capability to override.

Vulnerability Details

Property Value
CVE ID CVE-2026-46333
Type Information Disclosure
CWE CWE-862: Missing Authorization
CVSS Score 7.1 (High)
Attack Vector Local
Affected Product Linux Kernel
Vendor Linux

PoC Usage

# Must be run as root on the target system
sudo python3 poc.py
sudo python3 poc.py --check-only
sudo python3 poc.py --pid 2  # Test specific kernel thread

The PoC enumerates kernel threads (tasks without mm), then attempts to read sensitive /proc/<pid>/stack, /proc/<pid>/wchan, and /proc/<pid>/syscall files to verify if the dumpable bypass allows unauthorized access.

Impact

  • Information Disclosure: Kernel thread stack traces, wait channels, and syscall information exposed
  • Capability Bypass: uid-0 processes with dropped capabilities can still access kernel thread details
  • Container Escape Risk: In containerized environments, this may leak host kernel information

Prevention

See the prevention/ directory for: - Snort rules: Detect exfiltration of kernel stack data and kernel thread enumeration results - Sigma rules: Detect kernel thread process access, /proc/stack file access, and capability drop followed by proc access patterns

  1. Update the kernel to the patched version
  2. Enable kernel.yama.ptrace_scope = 1 or higher to restrict ptrace
  3. Use seccomp profiles to block ptrace syscalls in containers
  4. Monitor audit logs for suspicious /proc access to kernel threads

Detection and prevention

Ready-to-deploy defensive rules for CVE-2026-46333, for authorized testing and blue-team detection engineering:

References: NVD — CVE-2026-46333 · full write-up on the searchable site

Detection & prevention rules

# CVE-2026-46333 - Linux Kernel ptrace get_dumpable() Logic Bypass
# Note: This is a LOCAL vulnerability. Network-based detection is limited
# to monitoring for post-exploitation indicators.

# Rule 1: Detect potential information exfiltration of kernel thread data
# Attacker may exfiltrate /proc/*/stack content over the network
alert tcp $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-46333 Potential Kernel Thread Stack Data Exfiltration";
    flow:to_server,established;
    content:"[<";
    content:">]";
    content:"0xffff";
    pcre:"/\[<[0-9a-f]{16}>\]\s+\w+\+0x[0-9a-f]+/";
    classtype:policy-violation;
    sid:2026463331; rev:1;
    metadata:cve CVE-2026-46333, severity high, cvss 7.1;
    reference:cve,2026-46333;
)

# Rule 2: Detect ptrace-based kernel thread scanning tools
# Tools that rapidly access multiple /proc/*/status files
alert tcp $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-46333 Kernel Thread Enumeration Results Exfiltration";
    flow:to_server,established;
    content:"kthreadd"; nocase;
    content:"ksoftirqd"; nocase; distance:0; within:512;
    content:"kworker"; nocase; distance:0; within:512;
    classtype:policy-violation;
    sid:2026463332; rev:1;
    metadata:cve CVE-2026-46333, severity medium, cvss 7.1;
    reference:cve,2026-46333;
)

:material-file-download: prevention/snort.rules

Frequently asked questions

What is CVE-2026-46333?

CVE-2026-46333 (Linux) is a High (7.1) vulnerability: In the Linux kernel, a vulnerability exists in the ptrace subsystem's get_dumpable()…. This entry ships ready-to-deploy detection and prevention rules (Snort, Sigma) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-46333?

Deploy the Snort detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-46333?

Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.

Other entries for the same vendor or product:

For authorized security testing and research only. See the full source and NVD record.