CVE-2026-46057: landlock: Fix LOG_SUBDOMAINS_OFF inheritance across fork()

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-27 · updated 2026-06-17

Description

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LOG_SUBDOMAINS_OFF inheritance across fork() hook_cred_transfer() only copies the Landlock security blob when the source credential has a domain. This is inconsistent with landlock_restrict_self() which can set LOG_SUBDOMAINS_OFF on a credential without creating a domain (via the ruleset_fd=-1 path): the field is committed but not preserved across fork() because the child's prepare_creds() calls hook_cred_transfer() which skips the copy when domain is NULL. This breaks the documented use case where a process mutes subdomain logs before forking sandboxed children: the children lose the muting and their domains produce unexpected audit records. Fix this by unconditionally copying the Landlock credential blob.

Affected products

Linux kernel: from 6.15 before 6.18.27; from 6.19 before 7.0.4 — fixed in 6.18.27, 7.0.4

How to fix

Upgrade to a fixed version: Linux kernel 6.18.27, 7.0.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-46057 or the next vulnerability affects your stack