Bug 2487000 (CVE-2026-46328)

Summary:	CVE-2026-46328 kernel: apparmor: fix rlimit for posix cpu timers
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's AppArmor security module. The system's rlimit (resource limit) for POSIX (Portable Operating System Interface) CPU timers was not correctly enforced. This issue, stemming from an overlooked step in applying resource limits, could allow a local attacker to bypass intended CPU time restrictions, potentially leading to excessive resource consumption or a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-09 14:01:35 UTC

In the Linux kernel, the following vulnerability has been resolved:

apparmor: fix rlimit for posix cpu timers

Posix cpu timers requires an additional step beyond setting the rlimit.
Refactor the code so its clear when what code is setting the
limit and conditionally update the posix cpu timers when appropriate.

Comment 1 Keith Grant 2026-06-09 16:37:08 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026060910-CVE-2026-46328-dc30@gregkh/T