In the Linux kernel, the following vulnerability has been resolved: fanotify: fix false positive on permission events fsnotify_get_mark_safe() may return false for a mark on an unrelated group, which results in bypassing the permission check. Fix by skipping over detached marks that are not in the current group.

A flaw was found in the Linux kernel's fanotify subsystem. This vulnerability allows for a bypass of permission checks because the `fsnotify_get_mark_safe()` function may incorrectly return false for marks on unrelated groups. This could enable an attacker to perform unauthorized actions by circumventing intended security restrictions.

This Moderate severity flaw in the Linux kernel's fanotify subsystem allows a local attacker to bypass security restrictions. An incorrect return value from `fsnotify_get_mark_safe()` can lead to unauthorized actions on Red Hat Enterprise Linux systems. Red Hat Enterprise Linux 10 2026-07-21T00:00:00Z RHSA-2026:42919 kernel-0:6.12.0-211.37.1.el10_2 Red Hat Enterprise Linux 8 2026-07-31T00:00:00Z RHSA-2026:49213 kernel-rt-0:4.18.0-553.150.1.rt7.491.el8_10 Red Hat Enterprise Linux 8 2026-07-31T00:00:00Z RHSA-2026:49214 kernel-0:4.18.0-553.150.1.el8_10 Red Hat Enterprise Linux 9 2026-07-22T00:00:00Z RHSA-2026:43307 kernel-0:5.14.0-687.29.1.el9_8 Red Hat Enterprise Linux 9 2026-07-22T00:00:00Z RHSA-2026:43307 kernel-0:5.14.0-687.29.1.el9_8 Red Hat Enterprise Linux 6 Out of support scope kernel Red Hat Enterprise Linux 7 Affected kernel Red Hat Enterprise Linux 7 Affected kernel-rt Red Hat Enterprise Linux 9 Affected kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-46150 https://nvd.nist.gov/vuln/detail/CVE-2026-46150 https://lore.kernel.org/linux-cve-announce/2026052822-CVE-2026-46150-c96d@gregkh/T