CVE-2026-46150: fanotify: fix false positive on permission events

Synopsis

A permission-check bypass vulnerability exists in the Linux kernel's fanotify subsystem, affecting kernel versions prior to the fix commits across the 6.6, 6.12, 6.18, and 7.0 stable trees. The bug is reachable locally by any low-privilege user with an existing shell on the host; no network access or victim interaction is needed. Successful exploitation allows an attacker to read files and modify data that should have been blocked by fanotify permission event checks. Patched-image rebuilds at versions 6.6.140, 6.12.88, 6.18.30, and 7.0.7 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to trigger the fanotify permission bypass.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative or root credentials to exploit the bypass.

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the vulnerable code path entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, memory-layout randomization, or other environmental preconditions.

Blast Radius

• Reads files whose access should have been denied by fanotify permission event checks, including sensitive configuration files, secrets, or application data on the host.
• Modifies files or data that fanotify permission hooks were intended to block, potentially corrupting application state or injecting malicious content into monitored paths.
• Bypasses security tools (such as antivirus or audit daemons) that rely on fanotify permission events to intercept and approve or deny file operations.