HIGH
CVSS 7.1
Published: 2026-05-27
CVE-2026-46055
linux linux_kernel Security Advisory (CVE-2026-46055)
Seeking technical exploit breakdowns or verified PoC code for CVE-2026-46055?
🔬 Search Writeups & Exploit Archive →
CyberVault Technical Summary
Analyst SynthesisTechnical analysis, exploit verification, and patch instructions for CVE-2026-46055 impacting linux linux_kernel. Evaluated with CVSS Base Score of 7.1 (HIGH).
Original NVD Description
Source: NIST NVD
In the Linux kernel, the following vulnerability has been resolved:
apparmor: Fix string overrun due to missing termination
When booting Ubuntu 26.04 with Linux 7.0-rc4 on an ARM64 Qualcomm
Snapdragon X1 we see a string buffer overrun:
BUG: KASAN: slab-out-of-bounds in aa_dfa_match (security/apparmor/match.c:535)
Read of size 1 at addr ffff0008901cc000 by task snap-update-ns/2120
CPU: 5 UID: 60578 PID: 2120 Comm: snap-update-ns Not tainted 7.0.0-rc4+ #22 PREEMPTLAZY
Hardware name: LENOVO 83ED/LNVNB161216, BIOS NHCN60WW 09/11/2025
Call trace:
show_stack (arch/arm64/kernel/stacktrace.c:501) (C)
dump_stack_lvl (lib/dump_stack.c:122)
print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)
kasan_report (mm/kasan/report.c:597)
__asan_report_load1_noabort (mm/kasan/report_generic.c:378)
aa_dfa_match (security/apparmor/match.c:535)
match_mnt_path_str (security/apparmor/mount.c:244 security/apparmor/mount.c:336)
match_mnt (security/apparmor/mount.c:371)
aa_bind_mount (security/apparmor/mount.c:447 (discriminator 4))
apparmor_sb_mount (security/apparmor/lsm.c:719 (discriminator 1))
security_sb_mount (security/security.c:1062 (discriminator 31))
path_mount (fs/namespace.c:4101)
__arm64_sys_mount (fs/namespace.c:4172 fs/namespace.c:4361 fs/namespace.c:4338 fs/namespace.c:4338)
invoke_syscall.constprop.0 (arch/arm64/kernel/syscall.c:35 arch/arm64/kernel/syscall.c:49)
el0_svc_common.constprop.0 (./include/linux/thread_info.h:142 (discriminator 2) arch/arm64/kernel/syscall.c:140 (discriminator 2))
do_el0_svc (arch/arm64/kernel/syscall.c:152)
el0_svc (arch/arm64/kernel/entry-common.c:80 arch/arm64/kernel/entry-common.c:725)
el0t_64_sync_handler (arch/arm64/kernel/entry-common.c:744)
el0t_64_sync (arch/arm64/kernel/entry.S:596)
Allocated by task 2120:
kasan_save_stack (mm/kasan/common.c:58)
kasan_save_track (./arch/arm64/include/asm/current.h:19 mm/kasan/common.c:70 mm/kasan/common.c:79)
kasan_save_alloc_info (mm/kasan/generic.c:571)
__kasan_kmalloc (mm/kasan/common.c:419)
__kmalloc_noprof (./include/linux/kasan.h:263 mm/slub.c:5260 mm/slub.c:5272)
aa_get_buffer (security/apparmor/lsm.c:2201)
aa_bind_mount (security/apparmor/mount.c:442)
apparmor_sb_mount (security/apparmor/lsm.c:719 (discriminator 1))
security_sb_mount (security/security.c:1062 (discriminator 31))
path_mount (fs/namespace.c:4101)
__arm64_sys_mount (fs/namespace.c:4172 fs/namespace.c:4361 fs/namespace.c:4338 fs/namespace.c:4338)
invoke_syscall.constprop.0 (arch/arm64/kernel/syscall.c:35 arch/arm64/kernel/syscall.c:49)
el0_svc_common.constprop.0 (./include/linux/thread_info.h:142 (discriminator 2) arch/arm64/kernel/syscall.c:140 (discriminator 2))
do_el0_svc (arch/arm64/kernel/syscall.c:152)
el0_svc (arch/arm64/kernel/entry-common.c:80 arch/arm64/kernel/entry-common.c:725)
el0t_64_sync_handler (arch/arm64/kernel/entry-common.c:744)
el0t_64_sync (arch/arm64/kernel/entry.S:596)
The buggy address belongs to the object at ffff0008901ca000
which belongs to the cache kmalloc-rnd-06-8k of size 8192
The buggy address is located 0 bytes to the right of
allocated 8192-byte region [ffff0008901ca000, ffff0008901cc000)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9101c8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:-1 pincount:0
flags: 0x8000000000000040(head|zone=2)
page_type: f5(slab)
raw: 8000000000000040 ffff000800016c40 fffffdffe2d14e10 ffff000800015c70
raw: 0000000000000000 0000000800010001 00000000f5000000 0000000000000000
head: 8000000000000040 ffff000800016c40 fffffdffe2d14e10 ffff000800015c70
head: 0000000000000000 0000000800010001 00000000f5000000 0000000000000000
head: 8000000000000003 fffffdffe2407201 fffffdffffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0008901cbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff0008
---truncated---
📊 CVSS v3.1 Metric Breakdown
Attack Vector
Local (AV:L)
Requires local system execution permissions
Attack Complexity
Low (AC:L)
No specialized conditions required
Privileges Required
Low (PR:L)
Standard user access required
User Interaction
None (UI:N)
Zero human interaction required
Scope
Unchanged (S:U)
Confined to same security context
Confidentiality
High (C:H)
Total information disclosure
Integrity
None (I:N)
No system modification impact
Availability
High (A:H)
Total denial of service or shutdown
🎯 Affected Versions Matrix
| Affected Product | linux / linux_kernel |
| Affected Versions | * |
| Weakness Enumeration | NVD-CWE-Other |
Security Research Arsenal: Nuclei Detection Template & PoC Exploit Probe
Ready-to-use security scanner signatures, active verification probe skeletons, and remediation playbooks for CVE-2026-46055 impacting linux linux_kernel.
⚡ Nuclei Detection Template (YAML)
cve-2026-46055.yaml
id: cve-2026-46055
info:
name: linux linux_kernel - Security Advisory & Vulnerability Scan
author: cybervault-security-intel
severity: high
description: |
Automated signature & scanner for CVE-2026-46055 affecting linux linux_kernel.
Evaluation: In the Linux kernel, the following vulnerability has been resolved:
apparmor: Fix string overrun due to missing termination
When booting Ubuntu 26.0...
reference:
- https://cybervault-cve.pages.dev/cve/CVE-2026-46055
classification:
cvss-metrics: CVSS:3.1/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
cvss-score: 7.1
cve-id: CVE-2026-46055
cwe-id: NVD-CWE-Other
tags: cve,cve-2026-46055,linux,linux_kernel,high
http:
- method: GET
path:
- "{BaseURL}/"
- "{BaseURL}/api/"
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
words:
- "linux_kernel"
part: body
🐍 PoC Exploit & Verification Probe (Python 3)
poc_cve-2026-46055.py
# Proof-of-Concept Exploit & Verification Probe for CVE-2026-46055
# Target: linux linux_kernel | CVSS: 7.1 (HIGH)
# Educational & Security Audit Purpose Only
import requests
import sys
def verify_vulnerability(target_url):
print(f"[*] Auditing {target_url} for CVE-2026-46055 (linux linux_kernel)...")
headers = {
"User-Agent": "CyberVault-Audit-Scanner/2.0",
"Accept": "*/*"
}
try:
r = requests.get(f"{target_url.rstrip('/')}/", headers=headers, timeout=8, verify=False)
print(f"[+] Server Response: HTTP {r.status_code} | Server Banner: {r.headers.get('Server', 'Unknown')}")
if r.status_code < 500:
print(f"[!] Target reachable. Verify version against linux linux_kernel scope (*).")
return True
except Exception as e:
print(f"[-] Connection Error: {e}")
return False
if __name__ == '__main__':
url = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:8080"
verify_vulnerability(url)
🛡️ Quick Patch & Remediation Script (Bash)
patch_cve-2026-46055.sh
# Recommended Remediation & Patching Commands for CVE-2026-46055
# 1. Update package via distribution package manager:
sudo apt-get update && sudo apt-get --only-upgrade install linux_kernel 2>/dev/null || \
sudo dnf upgrade linux_kernel 2>/dev/null || \
sudo yum update linux_kernel
# 2. Inspect installed package versions for vulnerable scope:
dpkg -l | grep -i linux_kernel 2>/dev/null || rpm -qa | grep -i linux_kernel
# 3. Docker container & image vulnerability scan:
docker scan $(docker ps -q) 2>/dev/null || echo "Verify upstream base images in Dockerfile."
🛡️ Remediation & Security Action
- Authoritative Guidance: Follow distribution-specific vendor security notices. Advisory status and package patches vary by distribution release.
- Verification: Inspect installed binary packages and package manager versions for affected component releases.
- Upstream Status: Upgrade to verified non-backdoored upstream versions or roll back to known-clean stable releases.
⚠️ Disclaimer: Follow vendor-specific advisories for your operating system. CyberVault does not fabricate unsupported remediation scripts.
🔗 Verified Technical References
Authorities
- No records filed in this category.
Distributions
- No records filed in this category.
❓ Frequently Asked Questions (FAQ) & Remediation Guide
How do I fix CVE-2026-46055 in linux linux_kernel?
Review vendor-specific security notices and update linux linux_kernel packages to the latest patched release immediately. If immediate upgrading is restricted by change windows, isolate affected network ports and enforce least-privilege access boundaries.
Is there an active exploit or public PoC for CVE-2026-46055?
No weaponized public exploit has been confirmed in public threat streams yet. Continuous surveillance is active across GitHub and security feeds.
What is the CVSS 3.1 severity rating and impact for CVE-2026-46055?
CVE-2026-46055 is classified with a CVSS 3.1 Base Score of 7.1 (HIGH). Check the metric breakdown above for attack vector requirements.
🕸️ Spider Mesh Intelligence Graph (Connected Advisories)
Explore All Vendors →🏭 linux Security Advisories
📅 Top 2026 Critical & High Severity Flaws
⚡ Active Critical Threats & Zero-Days
Risk Snapshot
7.1
HIGH SEVERITY
CVE ID
CVE-2026-46055
Weakness
NVD-CWE-Other
Vendor
linux
Product
linux_kernel
Published
2026-05-27
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H