CVE-2026-80928

Received Received - Intake

Use-After-Free in Linux Kernel Smack LSM

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: smack: fix cred UAF in smack_file_send_sigiotask() When inspecting the credentials of another task, objective credentials (->real_cred, accessed with __task_cred()) must always be used. Accessing ->cred on a non-current task is forbidden unless that task is being created or destroyed; a task is allowed to change its own ->cred pointer with no synchronization, and changing ->cred should only affect the current syscall. smack_file_send_sigiotask() was accessing both sets of credentials: First tsk->cred, then __task_cred(tsk). Fix it, always access the objective credentials here. I have tested that this bug can lead to a KASAN-reported UAF of struct cred in smack_file_send_sigiotask(), and that this fix prevents the race.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-80928

EUVD

EUVD-2026-76251

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's Smack security module. It occurs in the function smack_file_send_sigiotask() where the code incorrectly accesses task credentials. The vulnerability arises from mixing two types of credentials: tsk->cred and __task_cred(tsk). The fix ensures only objective credentials (__task_cred) are used to prevent a race condition that could lead to a UAF of the struct cred.

Detection Guidance

This vulnerability is specific to the Linux kernel's Smack LSM module and requires kernel-level inspection. Detection involves checking kernel logs for KASAN-reported UAF errors in smack_file_send_sigiotask() or analyzing kernel source code for improper credential access patterns. No direct network commands exist for detection.

Impact Analysis

This vulnerability could allow an attacker to exploit a race condition in the Smack module, potentially causing a kernel crash or unauthorized access. If successfully exploited, it may lead to system instability, privilege escalation, or denial of service. Systems using the Linux kernel with Smack enabled are at risk.

Compliance Impact

This vulnerability is a use-after-free (UAF) issue in the Linux kernel's SMACK module, which could lead to memory corruption or crashes. It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy controls rather than kernel memory safety. However, if exploited, it could potentially disrupt system integrity, indirectly impacting secure processing of sensitive data.

Mitigation Strategies

Apply the kernel patch that fixes the Smack credential access issue. Update to a patched Linux kernel version where smack_file_send_sigiotask() uses __task_cred(tsk) consistently. Reboot the system after applying the patch to ensure the updated kernel is active.

Hi! I’m here to help you understand CVE-2026-80928. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70