CVE-2026-46055

HIGHPre-NVD 7.17.1—
EchelonGraph scoreMEDIUM confidence

Score 7.1 from GitHub Security Advisory (severity: HIGH) published 2026-05-27. a secondary CVSS source baseline 7.1; sources differ by 0.0.

Triggered by: GitHub Security Advisory CVSS
Sources: epss, ghsa, secondary
Trending — 3 sources updated this week
7.1EG
EchelonGraph verdictPlan a fixSerious severity, but no confirmed exploitation yet.
  • High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS PROB: 0%CVSS: 7.1Exploit: None knownExposed: 0

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

In the Linux kernel, the following vulnerability has been resolved:

apparmor: Fix string overrun due to missing termination

When booting Ubuntu 26.04 with Linux 7.0-rc4 on an ARM64 Qualcomm Snapdragon X1 we see a string buffer overrun:

BUG: KASAN: slab-out-of-bounds in aa_dfa_match (security/apparmor/match.c:535) Read of size 1 at addr ffff0008901cc000 by task snap-update-ns/2120

CPU: 5 UID: 60578 PID: 2120 Comm: snap-update-ns Not tainted 7.0.0-rc4+ #22 PREEMPTLAZY Hardware name: LENOVO 83ED/LNVNB161216, BIOS NHCN60WW 09/11/2025 Call trace: show_stack (arch/arm64/kernel/stacktrace.c:501) (C) dump_stack_lvl (lib/dump_stack.c:122) print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:597) __asan_report_load1_noabort (mm/kasan/report_generic.c:378) aa_dfa_match (security/apparmor/match.c:535) match_mnt_path_str (security/apparmor/mount.c:244 security/apparmor/mount.c:336) match_mnt (security/apparmor/mount.c:371) aa_bind_mount (security/apparmor/mount.c:447 (discriminator 4)) apparmor_sb_mount (security/apparmor/lsm.c:719 (discriminator 1)) security_sb_mount (security/security.c:1062 (discriminator 31)) path_mount (fs/namespace.c:4101) __arm64_sys_mount (fs/namespace.c:4172 fs/namespace.c:4361 fs/namespace.c:4338 fs/namespace.c:4338) invoke_syscall.constprop.0 (arch/arm64/kernel/syscall.c:35 arch/arm64/kernel/syscall.c:49) el0_svc_common.constprop.0 (./include/linux/thread_info.h:142 (discriminator 2) arch/arm64/kernel/syscall.c:140 (discriminator 2)) do_el0_svc (arch/arm64/kernel/syscall.c:152) el0_svc (arch/arm64/kernel/entry-common.c:80 arch/arm64/kernel/entry-common.c:725) el0t_64_sync_handler (arch/arm64/kernel/entry-common.c:744) el0t_64_sync (arch/arm64/kernel/entry.S:596)

Allocated by task 2120: kasan_save_stack (mm/kasan/common.c:58) kasan_save_track (./arch/arm64/include/asm/current.h:19 mm/kasan/common.c:70 mm/kasan/common.c:79) kasan_save_alloc_info (mm/kasan/generic.c:571) __kasan_kmalloc (mm/kasan/common.c:419) __kmalloc_noprof (./include/linux/kasan.h:263 mm/slub.c:5260 mm/slub.c:5272) aa_get_buffer (security/apparmor/lsm.c:2201) aa_bind_mount (security/apparmor/mount.c:442) apparmor_sb_mount (security/apparmor/lsm.c:719 (discriminator 1)) security_sb_mount (security/security.c:1062 (discriminator 31)) path_mount (fs/namespace.c:4101) __arm64_sys_mount (fs/namespace.c:4172 fs/namespace.c:4361 fs/namespace.c:4338 fs/namespace.c:4338) invoke_syscall.constprop.0 (arch/arm64/kernel/syscall.c:35 arch/arm64/kernel/syscall.c:49) el0_svc_common.constprop.0 (./include/linux/thread_info.h:142 (discriminator 2) arch/arm64/kernel/syscall.c:140 (discriminator 2)) do_el0_svc (arch/arm64/kernel/syscall.c:152) el0_svc (arch/arm64/kernel/entry-common.c:80 arch/arm64/kernel/entry-common.c:725) el0t_64_sync_handler (arch/arm64/kernel/entry-common.c:744) el0t_64_sync (arch/arm64/kernel/entry.S:596)

The buggy address belongs to the object at ffff0008901ca000 which belongs to the cache kmalloc-rnd-06-8k of size 8192 The buggy address is located 0 bytes to the right of allocated 8192-byte region [ffff0008901ca000, ffff0008901cc000)

The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9101c8 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:-1 pincount:0 flags: 0x8000000000000040(head|zone=2) page_type: f5(slab) raw: 8000000000000040 ffff000800016c40 fffffdffe2d14e10 ffff000800015c70 raw: 0000000000000000 0000000800010001 00000000f5000000 0000000000000000 head: 8000000000000040 ffff000800016c40 fffffdffe2d14e10 ffff000800015c70 head: 0000000000000000 0000000800010001 00000000f5000000 0000000000000000 head: 8000000000000003 fffffdffe2407201 fffffdffffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected

Memory state around the buggy address: ffff0008901cbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0008 ---truncated---

CVSS v3
7.1
EG Score
7.1(medium)
EG Risk
37(Track)
EG Risk 37/100SSVC: Track

EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).

How it’s computed
Severity71% × 45%
Exploitation0% × 40%
Automatability30% × 15%
Action: Routine — remediate on your standard cadence.
EPSS PROB
0%
EPSS %ILE
5%
KEV
Not listed

Published

May 27, 2026

Last Modified

June 16, 2026

Advisory Details (2)

Auto-updated Jun 12, 2026
No patch confirmed yet.
generic

apparmor: Fix string overrun due to missing termination - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/828bf7929bedcb79b560b5b4e44f22abee07d31b
generic

apparmor: Fix string overrun due to missing termination - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/4b877ef27adc8ec187b0418629169856e7264e01

Vendor Advisories for CVE-2026-46055(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Data Freshness Timeline

(refreshed 13× in last 7d / 37× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

Showing the most recent 100 of 136 total refreshes for this CVE.

  1. 2026-08-01 15:22 UTCEG score recompute
  2. 2026-08-01 15:22 UTCGHSA enrichment
  3. 2026-08-01 04:16 UTCEPSS rescore
  4. 2026-07-31 07:30 UTCEG score recompute
  5. 2026-07-31 07:30 UTCGHSA enrichment
  6. 2026-07-30 16:28 UTCEPSS rescore
  7. 2026-07-30 01:30 UTCEPSS rescore
  8. 2026-07-29 15:17 UTCEG score recompute
  9. 2026-07-29 15:17 UTCGHSA enrichment
  10. 2026-07-28 15:36 UTCEPSS rescore
  11. 2026-07-27 14:13 UTCEPSS rescore
  12. 2026-07-27 10:27 UTCEG score recompute
  13. 2026-07-27 10:27 UTCGHSA enrichment
  14. 2026-07-24 14:17 UTCEPSS rescore
  15. 2026-07-23 14:18 UTCEPSS rescore
  16. 2026-07-23 03:16 UTCEG score recompute
  17. 2026-07-22 14:08 UTCEPSS rescore
  18. 2026-07-21 15:24 UTCEPSS rescore
  19. 2026-07-20 17:08 UTCEPSS rescore
  20. 2026-07-19 14:31 UTCEPSS rescore
  21. 2026-07-18 10:04 UTCEPSS rescore
  22. 2026-07-16 17:03 UTCEPSS rescore
  23. 2026-07-15 16:57 UTCEPSS rescore
  24. 2026-07-15 02:00 UTCEPSS rescore
  25. 2026-07-13 22:30 UTCEPSS rescore
Show 75 more
  1. 2026-07-13 06:13 UTCEPSS rescore
  2. 2026-07-12 05:46 UTCEPSS rescore
  3. 2026-07-11 23:42 UTCGHSA enrichment
  4. 2026-07-11 08:27 UTCEPSS rescore
  5. 2026-07-09 19:10 UTCEPSS rescore
  6. 2026-07-08 23:51 UTCGHSA enrichment
  7. 2026-07-08 15:16 UTCEPSS rescore
  8. 2026-07-07 13:46 UTCEPSS rescore
  9. 2026-07-06 16:27 UTCEPSS rescore
  10. 2026-07-06 02:23 UTCEPSS rescore
  11. 2026-07-05 02:30 UTCEPSS rescore
  12. 2026-07-04 06:31 UTCEPSS rescore
  13. 2026-07-01 15:07 UTCEPSS rescore
  14. 2026-07-01 10:15 UTCGHSA enrichment
  15. 2026-06-30 23:22 UTCEPSS rescore
  16. 2026-06-30 03:21 UTCGHSA enrichment
  17. 2026-06-29 14:20 UTCGHSA enrichment
  18. 2026-06-29 14:06 UTCEPSS rescore
  19. 2026-06-29 14:06 UTCEPSS rescore
  20. 2026-06-28 20:57 UTCGHSA enrichment
  21. 2026-06-28 14:07 UTCEPSS rescore
  22. 2026-06-28 07:26 UTCGHSA enrichment
  23. 2026-06-28 04:56 UTCEPSS rescore
  24. 2026-06-28 04:56 UTCEPSS rescore
  25. 2026-06-27 18:32 UTCGHSA enrichment
  26. 2026-06-27 05:51 UTCGHSA enrichment
  27. 2026-06-27 03:08 UTCEPSS rescore
  28. 2026-06-26 17:06 UTCGHSA enrichment
  29. 2026-06-26 02:27 UTCGHSA enrichment
  30. 2026-06-25 13:49 UTCEPSS rescore
  31. 2026-06-25 13:46 UTCGHSA enrichment
  32. 2026-06-25 01:07 UTCGHSA enrichment
  33. 2026-06-24 14:05 UTCEPSS rescore
  34. 2026-06-23 21:33 UTCEPSS rescore
  35. 2026-06-23 21:33 UTCEPSS rescore
  36. 2026-06-22 14:25 UTCEPSS rescore
  37. 2026-06-22 14:25 UTCEPSS rescore
  38. 2026-06-21 14:56 UTCEPSS rescore
  39. 2026-06-21 14:56 UTCEPSS rescore
  40. 2026-06-21 01:59 UTCEPSS rescore
  41. 2026-06-21 01:59 UTCEPSS rescore
  42. 2026-06-19 19:26 UTCEPSS rescore
  43. 2026-06-19 19:26 UTCEPSS rescore
  44. 2026-06-18 17:52 UTCEPSS rescore
  45. 2026-06-18 17:52 UTCEPSS rescore
  46. 2026-06-17 18:42 UTCGHSA enrichment
  47. 2026-06-17 17:53 UTCEPSS rescore
  48. 2026-06-17 04:50 UTCGHSA enrichment
  49. 2026-06-16 17:52 UTCEPSS rescore
  50. 2026-06-16 16:06 UTCGHSA enrichment
  51. 2026-06-16 02:10 UTCGHSA enrichment
  52. 2026-06-15 17:49 UTCEPSS rescore
  53. 2026-06-15 13:30 UTCGHSA enrichment
  54. 2026-06-14 21:56 UTCGHSA enrichment
  55. 2026-06-14 09:17 UTCGHSA enrichment
  56. 2026-06-13 23:00 UTCEPSS rescore
  57. 2026-06-13 20:38 UTCGHSA enrichment
  58. 2026-06-13 04:32 UTCGHSA enrichment
  59. 2026-06-12 23:12 UTCEPSS rescore
  60. 2026-06-12 23:12 UTCEPSS rescore
  61. 2026-06-12 15:52 UTCGHSA enrichment
  62. 2026-06-12 03:13 UTCGHSA enrichment
  63. 2026-06-11 14:34 UTCGHSA enrichment
  64. 2026-06-11 14:00 UTCEPSS rescore
  65. 2026-06-11 01:55 UTCGHSA enrichment
  66. 2026-06-10 22:18 UTCEPSS rescore
  67. 2026-06-10 13:22 UTCEPSS rescore
  68. 2026-06-10 13:22 UTCEPSS rescore
  69. 2026-06-10 13:16 UTCGHSA enrichment
  70. 2026-06-10 00:37 UTCGHSA enrichment
  71. 2026-06-09 11:58 UTCGHSA enrichment
  72. 2026-06-08 23:20 UTCGHSA enrichment
  73. 2026-06-08 14:17 UTCEPSS rescore
  74. 2026-06-08 14:17 UTCEPSS rescore
  75. 2026-06-08 10:40 UTCGHSA enrichment

Frequently asked(5)

What is CVE-2026-46055?
CVE-2026-46055 is a high vulnerability published on May 27, 2026. In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix string overrun due to missing termination When booting Ubuntu 26.04 with Linux 7.0-rc4 on an ARM64 Qualcomm Snapdragon X1 we see a string buffer overrun: BUG: KASAN: slab-out-of-bounds in aadfamatch…
When was CVE-2026-46055 disclosed?
CVE-2026-46055 was first published in the National Vulnerability Database on May 27, 2026, with the most recent update on June 16, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-46055 actively exploited?
CVE-2026-46055 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0% probability of exploitation in the next 30 days, which ranks it in the top 95.3% of all scored CVEs.
What is the CVSS score of CVE-2026-46055?
CVE-2026-46055 has a CVSS v3 base score of 7.1 (NVD).
How do I remediate CVE-2026-46055?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-46055, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

Explore the affected products and dependency analysis for CVE-2026-46055

Explore →

Is Your Infrastructure Affected by CVE-2026-46055?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs