CVE-2026-46057

The record

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LOG_SUBDOMAINS_OFF inheritance across fork() hook_cred_transfer() only copies the Landlock security blob when the source credential has a domain. This is inconsistent with landlock_restrict_self() which can set LOG_SUBDOMAINS_OFF on a credential without creating a domain (via the ruleset_fd=-1 path): the field is committed but not preserved across fork() because the child's prepare_creds() calls hook_cred_transfer() which skips the copy when domain is NULL. This breaks the documented use case where a process mutes subdomain logs before forking sandboxed children: the children lose the muting and their domains produce unexpected audit records. Fix this by unconditionally copying the Landlock credential blob.

Affected packages

Related vulnerabilities

• CVE-2026-53354 In the Linux kernel, the following vulnerability has been resolved: arm64: errata… Also affects kernel-source
• CVE-2026-53325 In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken… Also affects kernel-source
• CVE-2026-52946 In the Linux kernel, the following vulnerability has been resolved: fs/fcntl: fix… Also affects kernel-source
• CVE-2026-52907 In the Linux kernel, the following vulnerability has been resolved: media: rockchip… Also affects kernel-source
• CVE-2026-52906 In the Linux kernel, the following vulnerability has been resolved: 9p: fix access mode… Also affects kernel-source
• CVE-2026-52905 In the Linux kernel, the following vulnerability has been resolved: mm/damon/core… Also affects kernel-source
• CVE-2026-52904 In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix… Also affects kernel-source
• CVE-2026-46332 In the Linux kernel, the following vulnerability has been resolved: greybus… Also affects kernel-source