EUVD-2026-76251
GHSA-pw4j-jrv7-fq3m
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AV:L (local exploit only), AC:H (exploiting a race condition requires precise timing), PR:L (requires local user account); full C/I/A impact from UAF of struct cred.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
smack: fix cred UAF in smack_file_send_sigiotask()
When inspecting the credentials of another task, objective credentials (->real_cred, accessed with __task_cred()) must always be used.
Accessing ->cred on a non-current task is forbidden unless that task is being created or destroyed; a task is allowed to change its own ->cred pointer with no synchronization, and changing ->cred should only affect the current syscall.
smack_file_send_sigiotask() was accessing both sets of credentials: First tsk->cred, then __task_cred(tsk).
Fix it, always access the objective credentials here.
I have tested that this bug can lead to a KASAN-reported UAF of struct cred in smack_file_send_sigiotask(), and that this fix prevents the race.
AnalysisAI
Use-after-free in the Linux kernel's Smack LSM smack_file_send_sigiotask() function allows a local attacker with low privileges to trigger kernel memory corruption by racing credential pointer changes on a non-current task. The function incorrectly accessed both tsk->cred (subjective credentials, unprotected) and __task_cred(tsk) (objective credentials) on the same task; because a task may change its own ->cred pointer at any time without synchronization, the first access can race with a credential transition, yielding a freed struct cred deref. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) The Linux kernel must be compiled with Smack LSM support (`CONFIG_SECURITY_SMACK=y`) and Smack must be the active LSM at boot time (not the default on most distributions - Smack is commonly used in Tizen, some embedded/IoT Linux platforms, and explicitly configured server images); (2) A local attacker must have at minimum a standard user account (PR:L) on the system; (3) The attacker must be able to trigger async file I/O signal delivery to another task (e.g., via `F_SETOWN`/`F_SETSIG`/`O_ASYNC` on a file descriptor) while racing credential changes on the target task. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-supplied CVSS vector (AV:L/AC:L/PR:L) rates attack complexity as Low, but the underlying defect is a data race requiring precise timing between a credential transition and the async I/O signal delivery path - raising practical exploitation difficulty above what AC:L suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade to a patched kernel release: Linux 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1, available via kernel.org stable trees and the upstream commits referenced above. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Linux with Smack LSM enabled and assess which have unprivileged user access; contact your kernel vendor (Red Hat, Canonical, SUSE, etc.) to confirm patch availability for your distribution and kernel version. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today