EUVD-2026-65390
GHSA-w75p-534p-fxmc
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and high complexity reflect the PID-race requirement; PR:L for needed local account; unchanged scope as impact is confined to the GPU configuration subsystem.
Primary rating from Vendor (suse).
CVSS VectorVendor: suse
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Polkit Authentication Based on UnixProcessSubject / Peer PID in LACT on Linux allows an Authentication Bypass. This issue affects LACT through 0.10.0. Fixed by commit d0478fe42c2219454e272f96b1cbd29ab37ee566.
AnalysisAI
Authentication bypass in LACT (Linux AMD GPU Configuration Tool) through version 0.10.0 allows a local attacker with low privileges to circumvent Polkit-based access controls by exploiting PID reuse in the UnixProcessSubject / Peer PID authentication mechanism (CWE-290). By winning a race condition between Polkit's process identity check and authorization grant, an attacker can spoof their process as a legitimately authorized caller and gain unauthorized control over privileged GPU configuration operations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local account on the target system with at least low-privilege access (CVSS PR:L, AV:L), consistent with a standard Linux user session. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.3 with vector AV:L/AC:H/PR:L accurately reflects the constrained real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with a standard user account on a Linux system running LACT repeatedly spawns and terminates processes in rapid succession to cycle PIDs. During a window when Polkit is evaluating a legitimately authorized LACT request, the attacker's process acquires the recycled PID of the authorized caller, causing Polkit's UnixProcessSubject check to grant the attacker's process the pending authorization. … |
| Remediation | The upstream fix is available via commit d0478fe42c2219454e272f96b1cbd29ab37ee566 in the LACT GitHub repository (https://github.com/ilya-zlobintsev/LACT); however, a specific tagged release version incorporating this commit is not confirmed from the available data, so users should verify the latest release version from the repository or their distribution's package manager. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: conduct inventory of systems running LACT version 0.10.0 or earlier, with priority on systems handling sensitive or regulated GPU workloads. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today