LACT CVE-2026-75037

Exploitation requires a local account on the target system with at least low-privilege access (CVSS PR:L, AV:L), consistent with a standard Linux user session. LACT must be installed and actively running with Polkit integration enabled - this is a non-default configuration on most Linux systems, since LACT is not commonly pre-installed. The attacker must win a PID-reuse race condition (CVSS AC:H), which requires precise timing of process creation relative to Polkit's authentication window, limiting reliable exploitation to scripted or repeated attempts. Remote exploitation is not possible. Exploitation is further limited to the subset of Linux systems where LACT has been explicitly installed by the user.

The CVSS 4.0 score of 7.3 with vector AV:L/AC:H/PR:L accurately reflects the constrained real-world risk. Local access (AV:L) and high attack complexity (AC:H) are the primary limiting factors: only users with existing shell accounts on a machine actively running LACT are viable attackers, and exploitation depends on winning a timing-sensitive PID-reuse race. The high VC/VI/VA impact metrics represent worst-case outcomes - unauthorized modification of GPU power limits or clocks could cause hardware instability or data integrity issues, but direct confidentiality impact is less clear and likely context-dependent. No EPSS score was provided in the input data, and LACT is absent from the CISA KEV catalog, indicating no confirmed active exploitation. No public POC has been identified. The combination of local-only vector, race-condition requirement, and niche deployment footprint makes this a low-priority finding for most environments - primarily relevant to Linux enthusiast or gaming workstations, not enterprise infrastructure.

A local attacker with a standard user account on a Linux system running LACT repeatedly spawns and terminates processes in rapid succession to cycle PIDs. During a window when Polkit is evaluating a legitimately authorized LACT request, the attacker's process acquires the recycled PID of the authorized caller, causing Polkit's UnixProcessSubject check to grant the attacker's process the pending authorization. The attacker then issues privileged LACT commands - such as raising GPU power limits beyond safe thresholds - without possessing the required credentials.