Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-46150

In the Linux kernel, the following vulnerability has been resolved: fanotify: fix false positive on permission events fsnotify_get_mark_safe() may return false for a mark on an unrelated group, which results in bypassing the permission check. Fix by skipping over detached marks that are not in the current group.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:f5ba644184eb65d2c02cad5afb25d91c72bf1a76701716ac27859069e0f5a359
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["fs/notify/fsnotify.c","fs/notify/mark.c","include/linux/fsnotify_backend.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.12"},{"lessThan":"4.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected",…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0c7b95e51d0b604ed52e78ea40d8714a02183db436af3e5d8f2651643fc1e06e · sha256:be95f9ab77070469… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/notify/fsnotify.c","fs/notify/mark.c","include/linux/fsnotify_backend.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a24765332e129c1916d5a6615418b75599b8fcdc","status":"affected","version":"abc77577a669f424c5d0c185b9994f2621c52aa4","versionType":"git"},{"lessThan":"4a7611ad653785fcdea5ff5f4441e2b7d05b7f11","status":"affected","version":"abc77577a669f424c5d0c185b9994f2621c52aa4","versionType":"git"},{"lessThan":"04bb66be92f48ed13c3faf1139d892df228789bc","s…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0c7b95e51d0b604ed52e78ea40d8714a02183db436af3e5d8f2651643fc1e06e · sha256:be95f9ab77070469… · /containers/cna/affected/0

Affected products and versions

2 source assertions
{"defaultStatus":"affected","product":"Linux","programFiles":["fs/notify/fsnotify.c","fs/notify/mark.c","include/linux/fsnotify_backend.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.12"},{"lessThan":"4.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.258","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected",…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0c7b95e51d0b604ed52e78ea40d8714a02183db436af3e5d8f2651643fc1e06e · sha256:be95f9ab77070469… · /containers/cna/affected/1
{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/notify/fsnotify.c","fs/notify/mark.c","include/linux/fsnotify_backend.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a24765332e129c1916d5a6615418b75599b8fcdc","status":"affected","version":"abc77577a669f424c5d0c185b9994f2621c52aa4","versionType":"git"},{"lessThan":"4a7611ad653785fcdea5ff5f4441e2b7d05b7f11","status":"affected","version":"abc77577a669f424c5d0c185b9994f2621c52aa4","versionType":"git"},{"lessThan":"04bb66be92f48ed13c3faf1139d892df228789bc","s…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0c7b95e51d0b604ed52e78ea40d8714a02183db436af3e5d8f2651643fc1e06e · sha256:be95f9ab77070469… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:0c7b95e51d0b604ed52e78ea40d8714a02183db436af3e5d8f2651643fc1e06e · sha256:be95f9ab77070469… · /containers/cna/metrics/0/cvssV3_1

Source references

8 source assertions
{"url":"https://git.kernel.org/stable/c/04bb66be92f48ed13c3faf1139d892df228789bc"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0c7b95e51d0b604ed52e78ea40d8714a02183db436af3e5d8f2651643fc1e06e · sha256:be95f9ab77070469… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/4a7611ad653785fcdea5ff5f4441e2b7d05b7f11"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0c7b95e51d0b604ed52e78ea40d8714a02183db436af3e5d8f2651643fc1e06e · sha256:be95f9ab77070469… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/7746e3bd4cc19b5092e00d32d676e329bfcb6900"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0c7b95e51d0b604ed52e78ea40d8714a02183db436af3e5d8f2651643fc1e06e · sha256:be95f9ab77070469… · /containers/cna/references/7
{"url":"https://git.kernel.org/stable/c/7baa02b0ae9d17ec5f08836d8ea88ce1927d0678"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0c7b95e51d0b604ed52e78ea40d8714a02183db436af3e5d8f2651643fc1e06e · sha256:be95f9ab77070469… · /containers/cna/references/5
{"url":"https://git.kernel.org/stable/c/895ebbedf88318607c24acc0f591c74b165e1d0a"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0c7b95e51d0b604ed52e78ea40d8714a02183db436af3e5d8f2651643fc1e06e · sha256:be95f9ab77070469… · /containers/cna/references/3
{"url":"https://git.kernel.org/stable/c/a24765332e129c1916d5a6615418b75599b8fcdc"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0c7b95e51d0b604ed52e78ea40d8714a02183db436af3e5d8f2651643fc1e06e · sha256:be95f9ab77070469… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/b7b24b28c8cd55844cab908f4f39dded638d5538"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0c7b95e51d0b604ed52e78ea40d8714a02183db436af3e5d8f2651643fc1e06e · sha256:be95f9ab77070469… · /containers/cna/references/6
{"url":"https://git.kernel.org/stable/c/f130790f1acc8399f32652846c875a251efd040f"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0c7b95e51d0b604ed52e78ea40d8714a02183db436af3e5d8f2651643fc1e06e · sha256:be95f9ab77070469… · /containers/cna/references/4

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer