ptrace: slightly saner 'get_dumpable()' logic

jira VULN-185427
cve CVE-2026-46333
commit-author Linus Torvalds <torvalds@linux-foundation.org>
commit 31e62c2
upstream-diff |
	Used RH_KABI_FILL_HOLE(unsigned user_dumpable:1) in task_struct
	to fix kabi check.
	The kabi check failes otherwise, not because the size of the struct
	changes (there is a payload of 15 unused bits), but because the
	checksum is different. RH_KABI_FILL_HOLE bypasses that.

The 'dumpability' of a task is fundamentally about the memory image of
the task - the concept comes from whether it can core dump or not - and
makes no sense when you don't have an associated mm.

And almost all users do in fact use it only for the case where the task
has a mm pointer.

But we have one odd special case: ptrace_may_access() uses 'dumpable' to
check various other things entirely independently of the MM (typically
explicitly using flags like PTRACE_MODE_READ_FSCREDS).  Including for
threads that no longer have a VM (and maybe never did, like most kernel
threads).

It's not what this flag was designed for, but it is what it is.

The ptrace code does check that the uid/gid matches, so you do have to
be uid-0 to see kernel thread details, but this means that the
traditional "drop capabilities" model doesn't make any difference for
this all.

Make it all make a *bit* more sense by saying that if you don't have a
MM pointer, we'll use a cached "last dumpability" flag if the thread
ever had a MM (it will be zero for kernel threads since it is never
set), and require a proper CAP_SYS_PTRACE capability to override.

	Reported-by: Qualys Security Advisory <qsa@qualys.com>
	Cc: Oleg Nesterov <oleg@redhat.com>
	Cc: Kees Cook <kees@kernel.org>
	Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit 31e62c2)
	Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

Author: roxanan1996

include/linux/sched.h

@@ -868,6 +868,10 @@ struct task_struct {
 	RH_KABI_FILL_HOLE(unsigned	sched_psi_wake_requeue:1)
 #endif
 
+	/* Save user-dumpable when mm goes away */
+	RH_KABI_FILL_HOLE(unsigned	user_dumpable:1)
+
+
 	/* Force alignment to the next boundary: */
 	unsigned			:0;
 

kernel/exit.c

@@ -494,6 +494,7 @@ static void exit_mm(void)
 	 */
 	smp_mb__after_spinlock();
 	local_irq_disable();
+	current->user_dumpable = (get_dumpable(mm) == SUID_DUMP_USER);
 	current->mm = NULL;
 	membarrier_update_current_mm(NULL);
 	enter_lazy_tlb(mm, current);

kernel/ptrace.c

@@ -283,11 +283,24 @@ static int ptrace_has_cap(struct user_namespace *ns, unsigned int mode)
 		return has_ns_capability(current, ns, CAP_SYS_PTRACE);
 }
 
+static bool task_still_dumpable(struct task_struct *task, unsigned int mode)
+{
+	struct mm_struct *mm = task->mm;
+	if (mm) {
+		if (get_dumpable(mm) == SUID_DUMP_USER)
+			return true;
+		return ptrace_has_cap(mm->user_ns, mode);
+	}
+
+	if (task->user_dumpable)
+		return true;
+	return ptrace_has_cap(&init_user_ns, mode);
+}
+
 /* Returns 0 on success, -errno on denial. */
 static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
 {
 	const struct cred *cred = current_cred(), *tcred;
-	struct mm_struct *mm;
 	kuid_t caller_uid;
 	kgid_t caller_gid;
 
@@ -348,11 +361,8 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
 	 * Pairs with a write barrier in commit_creds().
 	 */
 	smp_rmb();
-	mm = task->mm;
-	if (mm &&
-	    ((get_dumpable(mm) != SUID_DUMP_USER) &&
-	     !ptrace_has_cap(mm->user_ns, mode)))
-	    return -EPERM;
+	if (!task_still_dumpable(task, mode))
+		return -EPERM;
 
 	return security_ptrace_access_check(task, mode);
 }