CVE-2026-46328: apparmor: fix rlimit for posix cpu timers

Synopsis

A privilege-escalation flaw exists in the Linux kernel's AppArmor subsystem, specifically in how it handles rlimit enforcement for POSIX CPU timers. The bug is reachable locally by any low-privilege user with an existing session on the host; no network access is needed. Successful exploitation allows an attacker to corrupt integrity of limited kernel data and cause a denial of service by crashing or hanging affected processes or the timer subsystem. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to attempt exploitation; no administrator or root credentials are needed upfront.

• Victim interactionNot required

  No action by another user or administrator is required; the attacker can trigger the flaw unilaterally.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental setup beyond having a local session.

Blast Radius

• The attacker can modify limited kernel-managed data structures related to POSIX CPU timer rlimit enforcement, undermining process resource controls.
• The attacker can crash or indefinitely stall affected processes or the CPU timer subsystem, causing denial of service for workloads on the host.
• Because the scope is changed (S:C in the CVSS vector), impact can extend beyond the attacker's own process boundary to affect other processes sharing the same kernel.