GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80928 (GCVE-0-2026-80928)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-14 11:58
VLAI
Title
smack: fix cred UAF in smack_file_send_sigiotask()
Summary
In the Linux kernel, the following vulnerability has been resolved: smack: fix cred UAF in smack_file_send_sigiotask() When inspecting the credentials of another task, objective credentials (->real_cred, accessed with __task_cred()) must always be used. Accessing ->cred on a non-current task is forbidden unless that task is being created or destroyed; a task is allowed to change its own ->cred pointer with no synchronization, and changing ->cred should only affect the current syscall. smack_file_send_sigiotask() was accessing both sets of credentials: First tsk->cred, then __task_cred(tsk). Fix it, always access the objective credentials here. I have tested that this bug can lead to a KASAN-reported UAF of struct cred in smack_file_send_sigiotask(), and that this fix prevents the race.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3b11a1decef07c19443d24ae926982bc8ec9f4c0 , < a512366d84e134a9eefc2cc40eeb6e80e2ec162c (git)
Affected: 3b11a1decef07c19443d24ae926982bc8ec9f4c0 , < 7c7fe043f3099d0d35002b248967f75e55345b93 (git)
Affected: 3b11a1decef07c19443d24ae926982bc8ec9f4c0 , < f9c7b1f2b9d8f4176d2632743f51400855978ace (git)
Affected: 3b11a1decef07c19443d24ae926982bc8ec9f4c0 , < b5bcf3adfa27279da4401ab8f1e1a706601a92be (git)
Affected: 3b11a1decef07c19443d24ae926982bc8ec9f4c0 , < ed64aa505875a3b4defd504ee8e59e1949246a62 (git)
Affected: 3b11a1decef07c19443d24ae926982bc8ec9f4c0 , < b791401bf389a1546a830d2b381ca60fe94c7870 (git)
Affected: 3b11a1decef07c19443d24ae926982bc8ec9f4c0 , < fedc88e38ce979a720cd2de042578cb5df3dc8de (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.29
Unaffected: 0 , < 2.6.29 (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/smack/smack_lsm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a512366d84e134a9eefc2cc40eeb6e80e2ec162c",
              "status": "affected",
              "version": "3b11a1decef07c19443d24ae926982bc8ec9f4c0",
              "versionType": "git"
            },
            {
              "lessThan": "7c7fe043f3099d0d35002b248967f75e55345b93",
              "status": "affected",
              "version": "3b11a1decef07c19443d24ae926982bc8ec9f4c0",
              "versionType": "git"
            },
            {
              "lessThan": "f9c7b1f2b9d8f4176d2632743f51400855978ace",
              "status": "affected",
              "version": "3b11a1decef07c19443d24ae926982bc8ec9f4c0",
              "versionType": "git"
            },
            {
              "lessThan": "b5bcf3adfa27279da4401ab8f1e1a706601a92be",
              "status": "affected",
              "version": "3b11a1decef07c19443d24ae926982bc8ec9f4c0",
              "versionType": "git"
            },
            {
              "lessThan": "ed64aa505875a3b4defd504ee8e59e1949246a62",
              "status": "affected",
              "version": "3b11a1decef07c19443d24ae926982bc8ec9f4c0",
              "versionType": "git"
            },
            {
              "lessThan": "b791401bf389a1546a830d2b381ca60fe94c7870",
              "status": "affected",
              "version": "3b11a1decef07c19443d24ae926982bc8ec9f4c0",
              "versionType": "git"
            },
            {
              "lessThan": "fedc88e38ce979a720cd2de042578cb5df3dc8de",
              "status": "affected",
              "version": "3b11a1decef07c19443d24ae926982bc8ec9f4c0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/smack/smack_lsm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.29"
            },
            {
              "lessThan": "2.6.29",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmack: fix cred UAF in smack_file_send_sigiotask()\n\nWhen inspecting the credentials of another task, objective credentials\n(-\u003ereal_cred, accessed with __task_cred()) must always be used.\n\nAccessing -\u003ecred on a non-current task is forbidden unless that task is\nbeing created or destroyed; a task is allowed to change its own -\u003ecred\npointer with no synchronization, and changing -\u003ecred should only affect the\ncurrent syscall.\n\nsmack_file_send_sigiotask() was accessing both sets of credentials: First\ntsk-\u003ecred, then __task_cred(tsk).\n\nFix it, always access the objective credentials here.\n\nI have tested that this bug can lead to a KASAN-reported UAF of struct cred\nin smack_file_send_sigiotask(), and that this fix prevents the race."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reachable only via local syscalls: fcntl(F_SETOWN)/O_ASYNC on a pipe or socket, then write or MSG_OOB so kill_fasync()/send_sigurg() call smack_file_send_sigiotask(). Same SIGIO path as CVE-2026-72183 (AV:L); a remote peer can raise SIGIO only on a socket the local attacker already owns.\nAC:L - The attacker controls both sides of the race: one thread loops faccessat() so access_override_creds() installs a non_rcu subjective cred that revert_creds()+put_cred() frees without RCU, while another thread writes the pipe or sends OOB to fire SIGIO. The fix author reproduced a KASAN cred UAF; the window is retryable.\nPR:L - pipe(), fcntl(F_SETOWN/F_SETFL), write(), and faccessat() need no capabilities. An unprivileged user namespace (unshare(CLONE_NEWUSER)) makes access() install the non_rcu override (non-root uid with caps, or real uid != fsuid). The UAF is kernel cred memory on the attacker\u2019s own task.\nUI:N - No victim action is required. The attacker arms fowner on their own file, overrides their own subjective creds via faccessat(), and triggers SIGIO themselves.\nS:U - This is in-kernel cred use-after-free leading to local privilege escalation within the kernel security authority. It is not a VM escape, IOMMU bypass, or userspace sandbox boundary crossing.\nC:H - This is a use-after-free of struct cred. After free, the cred slab can be sprayed so cred-\u003esecurity and the derived smack_known are attacker-controlled, enabling arbitrary kernel reads through smk_access() and smack_log(). Kernel UAF scores C:H.\nI:H - The same sprayed cred/task_smack/smack_known objects yield a fake-object primitive on the SIGIO path, exploitable for control-flow hijacking and arbitrary write as with other kernel cred UAFs. Kernel UAF scores I:H.\nA:H - The fix author confirmed a KASAN use-after-free of struct cred in smack_file_send_sigiotask(). Dereferencing the freed cred on the SIGIO path, including from kill_fasync() in interrupt context, causes a kernel oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:58:55.805Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a512366d84e134a9eefc2cc40eeb6e80e2ec162c"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c7fe043f3099d0d35002b248967f75e55345b93"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9c7b1f2b9d8f4176d2632743f51400855978ace"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5bcf3adfa27279da4401ab8f1e1a706601a92be"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed64aa505875a3b4defd504ee8e59e1949246a62"
        },
        {
          "url": "https://git.kernel.org/stable/c/b791401bf389a1546a830d2b381ca60fe94c7870"
        },
        {
          "url": "https://git.kernel.org/stable/c/fedc88e38ce979a720cd2de042578cb5df3dc8de"
        }
      ],
      "title": "smack: fix cred UAF in smack_file_send_sigiotask()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80928",
    "datePublished": "2026-09-11T19:42:04.044Z",
    "dateReserved": "2026-08-26T14:34:25.802Z",
    "dateUpdated": "2026-09-14T11:58:55.805Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80928",
      "date": "2026-09-17",
      "epss": "0.00129",
      "percentile": "0.02905"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "security/smack/smack_lsm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "a512366d84e134a9eefc2cc40eeb6e80e2ec162c",
                    "status": "affected",
                    "version": "3b11a1decef07c19443d24ae926982bc8ec9f4c0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7c7fe043f3099d0d35002b248967f75e55345b93",
                    "status": "affected",
                    "version": "3b11a1decef07c19443d24ae926982bc8ec9f4c0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f9c7b1f2b9d8f4176d2632743f51400855978ace",
                    "status": "affected",
                    "version": "3b11a1decef07c19443d24ae926982bc8ec9f4c0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b5bcf3adfa27279da4401ab8f1e1a706601a92be",
                    "status": "affected",
                    "version": "3b11a1decef07c19443d24ae926982bc8ec9f4c0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ed64aa505875a3b4defd504ee8e59e1949246a62",
                    "status": "affected",
                    "version": "3b11a1decef07c19443d24ae926982bc8ec9f4c0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b791401bf389a1546a830d2b381ca60fe94c7870",
                    "status": "affected",
                    "version": "3b11a1decef07c19443d24ae926982bc8ec9f4c0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fedc88e38ce979a720cd2de042578cb5df3dc8de",
                    "status": "affected",
                    "version": "3b11a1decef07c19443d24ae926982bc8ec9f4c0",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "security/smack/smack_lsm.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.29"
                  },
                  {
                    "lessThan": "2.6.29",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmack: fix cred UAF in smack_file_send_sigiotask()\n\nWhen inspecting the credentials of another task, objective credentials\n(-\u003ereal_cred, accessed with __task_cred()) must always be used.\n\nAccessing -\u003ecred on a non-current task is forbidden unless that task is\nbeing created or destroyed; a task is allowed to change its own -\u003ecred\npointer with no synchronization, and changing -\u003ecred should only affect the\ncurrent syscall.\n\nsmack_file_send_sigiotask() was accessing both sets of credentials: First\ntsk-\u003ecred, then __task_cred(tsk).\n\nFix it, always access the objective credentials here.\n\nI have tested that this bug can lead to a KASAN-reported UAF of struct cred\nin smack_file_send_sigiotask(), and that this fix prevents the race."
          }
        ],
        "id": "CVE-2026-80928",
        "lastModified": "2026-09-14T13:18:49.050",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:18:56.513",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7c7fe043f3099d0d35002b248967f75e55345b93"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a512366d84e134a9eefc2cc40eeb6e80e2ec162c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b5bcf3adfa27279da4401ab8f1e1a706601a92be"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b791401bf389a1546a830d2b381ca60fe94c7870"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ed64aa505875a3b4defd504ee8e59e1949246a62"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f9c7b1f2b9d8f4176d2632743f51400855978ace"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fedc88e38ce979a720cd2de042578cb5df3dc8de"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T13:53:59+00:00",
      "cve": "CVE-2026-80928",
      "id": "CVE-2026-80928",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: smack: fix cred UAF in smack_file_send_sigiotask()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80928.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:06:19Z",
      "cve": "CVE-2026-80928",
      "id": "CVE-2026-80928",
      "initial_release_date": "2026-09-15T01:06:19Z",
      "product_status:known_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80928",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80928.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.