CVE-2026-46333

An attacker with local access and low privileges (e.g., a regular user) can call ptrace-related operations (such as PTRACE_MODE_READ_FSCREDS) on kernel threads or other tasks that lack an mm pointer. Because the dumpable flag is never set for kernel threads (it defaults to zero), and the existing uid/gid check only requires root, a non-root user who has dropped capabilities can still inspect these threads. The attacker does not need to interact with any memory-mapped state; the bug is triggered purely through the ptrace access control path [CWE-269].

The vulnerability lies in the ptrace_may_access() function and the get_dumpable() logic in the Linux kernel's ptrace and fs/exec code paths. The advisory does not specify exact file paths or function names beyond the general ptrace subsystem and the dumpable flag handling.

The patch set modifies the dumpable logic so that when a task has no mm pointer, the code uses a cached "last dumpability" value (if the task ever had an mm) or falls back to requiring CAP_SYS_PTRACE. This closes the loophole where a task without an mm (e.g., a kernel thread) would report dumpable=0, which the old ptrace_may_access() path treated as "accessible" without requiring the proper capability. The fix ensures that kernel threads and other mm-less tasks are only accessible to callers holding CAP_SYS_PTRACE [patch_id=424469, patch_id=424470, patch_id=424471, patch_id=424472, patch_id=424473, patch_id=424474, patch_id=424475].