Linux Kernel up to 7.0.6/7.1-rc2 selinux information disclosure

Summaryinfo

A vulnerability classified as critical was found in Linux Kernel up to 7.0.6/7.1-rc2. Impacted is an unknown function of the component selinux. The manipulation results in information disclosure. This vulnerability is cataloged as CVE-2026-46302. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Linux Kernel up to 7.0.6/7.1-rc2. Affected is an unknown function of the component selinux. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: selinux: allow multiple opens of /sys/fs/selinux/policy Currently there can only be a single open of /sys/fs/selinux/policy at any time. This allows any process to block any other process from reading the kernel policy. The original motivation seems to have been a mix of preventing an inconsistent view of the policy size and preventing userspace from allocating kernel memory without bound, but this is arguably equally bad. Eliminate the policy_opened flag and shrink the critical section that the policy mutex is held. While we are making changes here, drop a couple of extraneous BUG_ONs.

The advisory is shared for download at git.kernel.org. This vulnerability is traded as CVE-2026-46302 since 05/13/2026. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/08/2026). The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 7.0.7 or 7.1-rc3 eliminates this vulnerability. Applying the patch 714362f3779dfa453a78ced32396a72726962a41/a02cd6805562305f936e807da83e253b719dd965 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3
• 7.0.4
• 7.0.5
• 7.0.6
• 7.1-rc1
• 7.1-rc2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion