CVE-2026-46302 selinux: allow multiple opens of /sys/fs/selinux/policy
A local attacker can block other processes from reading the SELinux policy by holding the single open file handle, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46302?
CVE-2026-46302 is a medium-severity denial of service vulnerability in Linux kernel, published on 8 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
selinux: allow multiple opens of /sys/fs/selinux/policy
Currently there can only be a single open of /sys/fs/selinux/policy at any time. This allows any process to block any other process from reading the kernel policy. The original motivation seems to have been a mix of preventing an inconsistent view of the policy size and preventing userspace from allocating kernel memory without bound, but this is arguably equally bad. Eliminate the policy_opened flag and shrink the critical section that the policy mutex is held. While we are making changes here, drop a couple of extraneous BUG_ONs.
Which versions are affected by CVE-2026-46302?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46302?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-46302 being exploited?
There is no known exploitation of CVE-2026-46302 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-89636, BELL-CVE-2026-46302, DEBIAN-CVE-2026-46302, GHSA-m47f-j4g8-cj3f, ROOT-OS-DEBIAN-11-CVE-2026-46302, ROOT-OS-DEBIAN-12-CVE-2026-46302 and 4 more.