HIGH Introduced in 2.6.29
smack SigioTask UAF
CVE-2026-80928
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: smack: fix cred UAF in smack_file_send_sigiotask() When inspecting the credentials of another task, objective credentials (->real_cred, accessed with __task_cred()) must always be used. Accessing ->cred on a non-current task is forbidden unless that task is being created or destroyed; a task is allowed to change its own ->cred pointer with no synchronization, and changing ->cred should only affect the current syscall. smack_file_send_sigiotask() was accessing both sets of credentials: First tsk->cred, then __task_cred(tsk). Fix it, always access the objective credentials here. I have tested that this bug can lead to a KASAN-reported UAF of struct cred in smack_file_send_sigiotask(), and that this fix prevents the race.
02KernelScan AI Analysis
Risk summary
A local unprivileged user can trigger a use-after-free of kernel credential structures on systems where the Smack LSM is active. The race condition occurs during asynchronous I/O signal delivery when Smack inspects another task's credentials. Successful exploitation could lead to kernel memory corruption, information disclosure, or denial of service.
Vulnerability analysis
When the kernel delivers an asynchronous I/O signal to a task, the Smack security module checks that task's credentials to decide whether the signal is allowed. The code incorrectly looked at credentials that the target task is permitted to change at any time without locking. This creates a race where the target task can free its old credential structure while Smack is still using it, resulting in a use-after-free. The fix changes the code to look at the stable, read-only credentials that are meant for inspection by other tasks. Any local user can reach this path through standard asynchronous I/O system calls, but only on systems where Smack is the active security module.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 2.6.29 | 5.15.221 | a512366d84e1 |
| 6.12 | 2.6.29 | 6.12.109 | b5bcf3adfa27 |
| 7.2 | 2.6.29 | 7.2.4 | b791401bf389 |
| 6.6 | 2.6.29 | 6.6.157 | f9c7b1f2b9d8 |
| mainline | 2.6.29 | 7.3-rc1 | fedc88e38ce9 |
| 6.1 | 2.6.29 | 6.1.188 | 7c7fe043f309 |
| 6.18 | 2.6.29 | 6.18.50 | ed64aa505875 |
| cip/6.12 | 2.6.29 | 6.12.111-cip32 | b5bcf3adfa27 |