Cloudanix VulnDB

CVE-2026-80928

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel's security module could let a local user cause memory corruption that might crash the system or allow taking control.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Use-after-free of struct cred caused by smack_file_send_sigiotask() reading tsk->cred instead of the objective credentials via __task_cred() on a non-current task, allowing a concurrent cred pointer change to free the structure while it is still in use.

Why it matters to the business

Local attackers on Linux systems using the Smack LSM can trigger kernel memory corruption leading to crashes or potential privilege escalation; systems must be updated promptly to avoid service disruption or compromise.

How an attack unfolds

An attacker running as a local user triggers smack_file_send_sigiotask() while concurrently modifying its own credentials; the function reads the now-stale cred pointer, resulting in a KASAN-detected UAF that an attacker can attempt to exploit for arbitrary code execution or denial of service.

How to fix it

Apply the upstream fix that replaces tsk->cred accesses with __task_cred() in smack_file_send_sigiotask(); rebuild and boot the corrected kernel; prioritize patching any systems still running vulnerable kernels published after 2026-09-11.

How to confirm the fix worked

Verify the patch is present by inspecting the smack_lsm.c source for exclusive use of __task_cred() in smack_file_send_sigiotask(); confirm the vulnerable access to tsk->cred is removed; test with KASAN-enabled kernels under concurrent credential modification workloads.

Typical attack path

  1. Obtain local code execution as a non-root user on a Smack-enabled kernel
  2. Race credential changes against smack_file_send_sigiotask() inspection path
  3. Trigger UAF on struct cred and attempt to control freed memory for escalation

How to detect it

Search kernel logs and KASAN reports for use-after-free warnings originating from smack_file_send_sigiotask(); correlate with processes performing rapid credential or capability changes; review audit logs for unusual Smack label or file I/O activity around the time of crashes.

  • smack_file_send_sigiotask
  • KASAN: use-after-free in smack_file_send_sigiotask
  • struct cred UAF

What your security team should do

  • Immediately schedule kernel updates for all Smack-enabled Linux hosts
  • Monitor for KASAN UAF reports referencing smack_file_send_sigiotask
  • Restrict local user access on high-value systems until patched

The record

In the Linux kernel, the following vulnerability has been resolved: smack: fix cred UAF in smack_file_send_sigiotask() When inspecting the credentials of another task, objective credentials (->real_cred, accessed with __task_cred()) must always be used. Accessing ->cred on a non-current task is forbidden unless that task is being created or destroyed; a task is allowed to change its own ->cred pointer with no synchronization, and changing ->cred should only affect the current syscall. smack_file_send_sigiotask() was accessing both sets of credentials: First tsk->cred, then __task_cred(tsk). Fix it, always access the objective credentials here. I have tested that this bug can lead to a KASAN-reported UAF of struct cred in smack_file_send_sigiotask(), and that this fix prevents the race.

Affected packages

Ecosystem Package Introduced Fixed