CyberSecBulletin
CVE-2026-46149NVD status: Modified

Linux: Uncontrolled Recursion

Published Updated By the CyberSecBulletin desk

CVE-2026-46149 is a high-severity uncontrolled recursion vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions d3cc9d490c207d57a289054397349f6f8c90354e, db0a4759d62cad4ff891e2d81ae4be73bb57f4a4, 12f2201a56957ba020392223a7393a5eba080c1b as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.14% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to d3cc9d490c207d57a289054397349f6f8c90354e or db0a4759d62cad4ff891e2d81ae4be73bb57f4a4 or 12f2201a56957ba020392223a7393a5eba080c1b or 1f678d13e939f91840cb1ebe9b88544923539d3c, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.258 or 5.15.209 or 6.1.175 or 6.6.140, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxc66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 up to, but not including, d3cc9d490c207d57a289054397349f6f8c90354e; c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 up to, but not including, db0a4759d62cad4ff891e2d81ae4be73bb57f4a4; c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 up to, but not including, 12f2201a56957ba020392223a7393a5eba080c1b; c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 up to, but not including, 1f678d13e939f91840cb1ebe9b88544923539d3c; c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 up to, but not including, 72cc5ea7ef32bb5fa38bf0dd2e56fcd73aa8c89e; c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 up to, but not including, 00d91bfdce5033f5d9b4915638ae9b0553848b5d; c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 up to, but not including, e501154f9d82c95d2719bcbbaf679d8fd3226ef7; c66ac9db8d4ad9994a02b3e933ea2ccc643e1fe5 up to, but not including, 772a896a56e0e3ef9424a025cec9176f9d8f4552; and 1 more rangesd3cc9d490c207d57a289054397349f6f8c90354e, db0a4759d62cad4ff891e2d81ae4be73bb57f4a4, 12f2201a56957ba020392223a7393a5eba080c1b, 1f678d13e939f91840cb1ebe9b88544923539d3c, 72cc5ea7ef32bb5fa38bf0dd2e56fcd73aa8c89e, 00d91bfdce5033f5d9b4915638ae9b0553848b5d
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystemall versionsNot stated
LinuxLinux Kernel2.6.38 up to, but not including, 5.10.258; 5.11 up to, but not including, 5.15.209; 5.16 up to, but not including, 6.1.175; 6.2 up to, but not including, 6.6.140; 6.7 up to, but not including, 6.12.88; 6.13 up to, but not including, 6.18.30; 6.19 up to, but not including, 7.0.7; 7.15.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.88, 6.18.30

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a 256-byte stack buffer, then will memcpy() cur_len bytes from that buffer. snprintf() returns the length the output would have had, which can exceed the buffer size when the fabric WWN is long because iSCSI IQN names can be up to 223 bytes. The check at the memcpy() site only guards the destination page write, not the source read, so memcpy() will read past the stack buffer and copy adjacent stack contents to the sysfs reader, which when CONFIG_FORTIFY_SOURCE is enabled, fortify_panic() will be triggered. Commit 27e06650a5ea ("scsi: target: target_core_configfs: Add length check to avoid buffer overflow") added the same bound to the target_lu_gp_members_show() but the tg_pt_gp variant was missed so resolve that here.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

How developers prevent this class of flaw

  • Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.

More Uncontrolled Recursion vulnerabilities (CWE-674)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Uncontrolled Recursion vulnerabilities

Spotted an error? Tell us.