Executive brief
A vulnerability was identified in the Linux kernel's process tracing (ptrace) subsystem. This component allows one process to observe and control the execution of another, which is essential for debugging tools. The flaw could allow certain processes to bypass security checks that normally prevent unauthorized access to sensitive kernel thread information, potentially leading to the exposure of system-level data.
Technical details
A vulnerability in the Linux kernel's ptrace_may_access() function stemmed from an inconsistent use of the 'dumpable' flag. Historically, dumpability was tied to a task's memory management (mm_struct) to determine if a core dump could be created. However, ptrace_may_access() used this flag to authorize access even for threads without an MM (like kernel threads or exiting threads). This allowed processes with UID 0 to bypass the 'drop capabilities' security model when accessing kernel thread details. The fix introduces a 'user_dumpable' cached flag in the task_struct and enforces a requirement for CAP_SYS_PTRACE when an MM is not present, ensuring more robust access control.
Affected products
- Linux Linux Kernel All versions prior to the fix (May 2026)
Timeline
- 2026-05-13: patched: Fix authored by Linus Torvalds
- 2026-05-15: disclosed: CVE published and patches merged into stable trees
References
- https://git.kernel.org/stable/c/01363cb3fbd0238ffdeb09f53e9039c9edf8a730
- https://git.kernel.org/stable/c/15b828a46f305ae9f05a7c16914b3ce273474205
- https://git.kernel.org/stable/c/2a93a4fac7b6051d3be7cd1b015fe7320cd0404d
- https://git.kernel.org/stable/c/4709234fd1b95136ceb789f639b1e7ea5de1b181
- https://git.kernel.org/stable/c/6e5b51e74a40d377bcd3081dd33fbaa0e1aa7e3d
- https://git.kernel.org/stable/c/8f907d345bae8f4b3f004c5abc56bf2dfb851ea7
- https://git.kernel.org/stable/c/93d4ba49d18e3d7fb41a9927c2d0cca5e9dfefd6