CVE-2026-46057: landlock: Fix LOG_SUBDOMAINS_OFF inheritance across fork()
In the Linux kernel, the following vulnerability has been resolved:
landlock: Fix LOGSUBDOMAINSOFF inheritance across fork()
hookcredtransfer() only copies the Landlock security blob when the source credential has a domain. This is inconsistent with landlockrestrictself() which can set LOGSUBDOMAINSOFF on a credential without creating a domain (via the rulesetfd=-1 path): the field is committed but not preserved across fork() because the child's preparecreds() calls hookcredtransfer() which skips the copy when domain is NULL.
This breaks the documented use case where a process mutes subdomain logs before forking sandboxed children: the children lose the muting and their domains produce unexpected audit records.
Fix this by unconditionally copying the Landlock credential blob.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46057?
CVE-2026-46057 has a low severity rating of 3.3 according to the CVSS 3.1 scoring system.
What does CVE-2026-46057 affect?
CVE-2026-46057 affects the Linux kernel and specifically concerns the Landlock security module's handling of LOG_SUBDOMAINS_OFF inheritance.
How do I fix CVE-2026-46057?
You can fix CVE-2026-46057 by applying the available patch from the Linux kernel source.
What are the implications of CVE-2026-46057?
The implications of CVE-2026-46057 include potential inconsistencies in the security policies applied to processes forked from affected credentials.
Is there a known exploit for CVE-2026-46057?
As of now, there are no public exploits known for CVE-2026-46057.