CVE-2025-71304: smack: /smack/doi: accept previously used values

Q: Which systems and users are exposed?

Exposure is limited to Linux systems using Smack where a local user with low privileges can write to /smack/doi. The issue affects networking for non-ambient Smack labels; no user interaction is required.

Q: What is the practical impact after exploitation?

Reusing a DOI value that was written previously can disable networking for processes running with non-ambient labels. The supplied example shows subsequent network attempts failing with an address-family error.

Q: How can administrators identify a suspected occurrence?

Kernel messages may show CIPSO removal and addition failures, including "remove rc = -2" and "cipso add rc = -17", after writes to /smack/doi. Affected non-ambient-labeled processes may then be unable to communicate over the network while the ambient label remains able to do so.

Published May 27, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

smack: /smack/doi: accept previously used values

Writing to /smack/doi a value that has ever been written there in the past disables networking for non-ambient labels. E.g.

# cat /smack/doi 3 # netlabelctl -p cipso list Configured CIPSO mappings (1) DOI value : 3 mapping type : PASSTHROUGH # netlabelctl -p map list Configured NetLabel domain mappings (3) domain: "" (IPv4) protocol: UNLABELED domain: DEFAULT (IPv4) protocol: CIPSO, DOI = 3 domain: DEFAULT (IPv6) protocol: UNLABELED

# cat /smack/ambient # cat /proc/$$/attr/smack/current # ping -c1 10.1.95.12 64 bytes from 10.1.95.12: icmpseq=1 ttl=64 time=0.964 ms # echo foo >/proc/$$/attr/smack/current # ping -c1 10.1.95.12 64 bytes from 10.1.95.12: icmpseq=1 ttl=64 time=0.956 ms unknown option 86

# echo 4 >/smack/doi # echo 3 >/smack/doi !> [ 214.050395] smkcipsodoi:691 cipso add rc = -17 # echo 3 >/smack/doi !> [ 249.402261] smkcipsodoi:678 remove rc = -2 !> [ 249.402261] smkcipsodoi:691 cipso add rc = -17

# ping -c1 10.1.95.12 !!> ping: 10.1.95.12: Address family for hostname not supported

# echo >/proc/$$/attr/smack/current # ping -c1 10.1.95.12 64 bytes from 10.1.95.12: icmpseq=1 ttl=64 time=0.617 ms

This happens because Smack keeps decommissioned DOIs, fails to re-add them, and consequently refuses to add the “default” domain map:

# netlabelctl -p cipso list Configured CIPSO mappings (2) DOI value : 3 mapping type : PASSTHROUGH DOI value : 4 mapping type : PASSTHROUGH # netlabelctl -p map list Configured NetLabel domain mappings (2) domain: "" (IPv4) protocol: UNLABELED !> (no ipv4 map for default domain here) domain: DEFAULT (IPv6) protocol: UNLABELED

Fix by clearing decommissioned DOI definitions and serializing concurrent DOI updates with a new lock.

Also: - allow /smack/doi to live unconfigured, since adding a map (netlblcfgcipsov4mapadd) may fail. CIPSOV4DOIUNKNOWN(0) indicates the unconfigured DOI - add new DOI before removing the old default map, so the old map remains if the add fails

(2008-02-04, Casey Schaufler)

Affected Software

249 affected componentsFixes available

Linux Linux kernel (Smack)

Linux Linux kernel>=2.6.25<5.10.252

Linux Linux kernel>=5.11<5.15.202

Linux Linux kernel>=5.16<6.1.165

Linux Linux kernel>=6.2<6.6.128

Linux Linux kernel>=6.7<6.12.75

Linux Linux kernel>=6.13<6.18.14

Linux Linux kernel>=6.19<6.19.4

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-azure*

ubuntu/linux-lts-xenial*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-hwe*

ubuntu/linux-azure*

ubuntu/linux-gcp*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-kvm*

ubuntu/linux-oracle*

ubuntu/linux-fips*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-aws-5.4*

ubuntu/linux-azure*

ubuntu/linux-azure-4.15*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-5.4*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-4.15*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-5.4*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-5.4*

ubuntu/linux-hwe-edge*

ubuntu/linux-ibm-5.4*

ubuntu/linux-kvm*

ubuntu/linux-oem*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-oracle-5.4*

ubuntu/linux-raspi-5.4*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15<5.15.0-1112.119~20.04.1

5.15.0-1112.119~20.04.1

ubuntu/linux-aws-5.8*

ubuntu/linux-azure*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15<5.15.0-1117.126~20.04.1

5.15.0-1117.126~20.04.1

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15<5.15.0-1117.126~20.04.2

5.15.0-1117.126~20.04.2

ubuntu/linux-bluefield*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15<5.15.0-1112.122~20.04.1

5.15.0-1112.122~20.04.1

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15<5.15.0-186.196~20.04.1

5.15.0-186.196~20.04.1

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm*

ubuntu/linux-ibm-5.15<5.15.0-1106.110~20.04.1

5.15.0-1106.110~20.04.1

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15<5.15.0-1107.113~20.04.1

5.15.0-1107.113~20.04.1

ubuntu/linux-iot*

ubuntu/linux-kvm*

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-184.194~20.04.1

5.15.0-184.194~20.04.1

ubuntu/linux-nvidia-tegra-5.15<5.15.0-1064.66~20.04.1

5.15.0-1064.66~20.04.1

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15<5.15.0-1109.115~20.04.1

5.15.0-1109.115~20.04.1

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15<5.15.0-1106.110~20.04.1

5.15.0-1106.110~20.04.1

ubuntu/linux-riscv-5.8*

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.15.0-186.196

5.15.0-186.196

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1112.119

5.15.0-1112.119

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1060.63~22.04.1

6.8.0-1060.63~22.04.1

ubuntu/linux-azure<5.15.0-1117.126

5.15.0-1117.126

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1063.71~22.04.1

6.8.0-1063.71~22.04.1

ubuntu/linux-azure-fde<5.15.0-1117.126

5.15.0-1117.126

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8<6.8.0-1062.69~22.04.1

6.8.0-1062.69~22.04.1

ubuntu/linux-gcp<5.15.0-1112.122

5.15.0-1112.122

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1063.69~22.04.1

6.8.0-1063.69~22.04.1

ubuntu/linux-gke<5.15.0-1108.114

5.15.0-1108.114

ubuntu/linux-gkeop<5.15.0-1095.103

5.15.0-1095.103

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-136.136~22.04.1

6.8.0-136.136~22.04.1

ubuntu/linux-ibm<5.15.0-1106.110

5.15.0-1106.110

ubuntu/linux-ibm-6.8<6.8.0-1060.61~22.04.1

6.8.0-1060.61~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1107.113

5.15.0-1107.113

ubuntu/linux-kvm<5.15.0-1104.109

5.15.0-1104.109

ubuntu/linux-lowlatency<5.15.0-184.194

5.15.0-184.194

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-134.134.1~22.04.1

6.8.0-134.134.1~22.04.1

ubuntu/linux-nvidia<5.15.0-1107.108

5.15.0-1107.108

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1058.61~22.04.1

6.8.0-1058.61~22.04.1

ubuntu/linux-nvidia-tegra<5.15.0-1064.66

5.15.0-1064.66

ubuntu/linux-nvidia-tegra-igx<5.15.0-1053.53

5.15.0-1053.53

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1109.115

5.15.0-1109.115

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1057.58~22.04.1

6.8.0-1057.58~22.04.1

ubuntu/linux-raspi<5.15.0-1106.109

5.15.0-1106.109

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-134.134~22.04.1

6.8.0-134.134~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp<5.15.0-1075.79

5.15.0-1075.79

ubuntu/linux-bluefield<5.15.0-1096.98

5.15.0-1096.98

ubuntu/linux-intel-iot-realtime<5.15.0-1104.106

5.15.0-1104.106

ubuntu/linux-realtime<5.15.0-1111.120

5.15.0-1111.120

ubuntu/linux-realtime-6.8<6.8.1-1055.56~22.04.1

6.8.1-1055.56~22.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips<5.15.0-1112.119+fips1

5.15.0-1112.119+fips1

ubuntu/linux-azure-fips<5.15.0-1117.126+fips1

5.15.0-1117.126+fips1

ubuntu/linux-fips<5.15.0-186.196+fips1

5.15.0-186.196+fips1

ubuntu/linux-gcp-fips<5.15.0-1112.122+fips1

5.15.0-1112.122+fips1

ubuntu/linux<6.8.0-134.134

6.8.0-134.134

ubuntu/linux-aws<6.8.0-1060.63

6.8.0-1060.63

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-azure<6.8.0-1063.71

6.8.0-1063.71

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17*

ubuntu/linux-azure-fde<6.8.0-1062.69

6.8.0-1062.69

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-nvidia*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp<6.8.0-1063.69

6.8.0-1063.69

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gke<6.8.0-1058.64

6.8.0-1058.64

ubuntu/linux-gkeop<6.8.0-1045.48

6.8.0-1045.48

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17*

ubuntu/linux-ibm<6.8.0-1060.61

6.8.0-1060.61

ubuntu/linux-lowlatency<6.8.0-134.134.1

6.8.0-134.134.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia<6.8.0-1058.61

6.8.0-1058.61

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17*

ubuntu/linux-nvidia-lowlatency<6.8.0-1058.61.1

6.8.0-1058.61.1

ubuntu/linux-nvidia-tegra<6.8.0-1029.30

6.8.0-1029.30

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17*

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1057.58

6.8.0-1057.58

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17*

ubuntu/linux-raspi<6.8.0-1060.64

6.8.0-1060.64

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-xilinx<6.8.0-1032.33

6.8.0-1032.33

ubuntu/linux-bluefield<6.8.0-1026.30

6.8.0-1026.30

ubuntu/linux-raspi-realtime<6.8.0-2049.50

6.8.0-2049.50

ubuntu/linux-realtime<6.8.1-1055.56

6.8.1-1055.56

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17*

ubuntu/linux-aws-fips<6.8.0-1060.63+fips1

6.8.0-1060.63+fips1

ubuntu/linux-azure-fips<6.8.0-1062.69+fips1

6.8.0-1062.69+fips1

ubuntu/linux-fips<6.8.0-134.134+fips1

6.8.0-134.134+fips1

ubuntu/linux-gcp-fips<6.8.0-1063.69+fips1

6.8.0-1063.69+fips1

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-azure*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp*

ubuntu/linux-oracle*

ubuntu/linux-raspi*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1112.119~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1117.126~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1117.126~20.04.2
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1112.122~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-186.196~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1106.110~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1107.113~20.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-184.194~20.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1064.66~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1109.115~20.04.1
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1106.110~20.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-186.196
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1112.119
Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1060.63~22.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1117.126
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1063.71~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1117.126
Upgrade
Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1062.69~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1112.122
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1063.69~22.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1108.114
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1095.103
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-136.136~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1106.110
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1060.61~22.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1107.113
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1104.109
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-184.194
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-134.134.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1107.108
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.61~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 5.15.0-1064.66
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.
Fixed in 5.15.0-1053.53
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1109.115
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1057.58~22.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1106.109
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-134.134~22.04.1
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.15.0-1075.79
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1096.98
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1104.106
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1111.120
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1055.56~22.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1112.119+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1117.126+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-186.196+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1112.122+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-134.134
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1060.63
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1063.71
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 6.8.0-1062.69
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1063.69
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.64
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1045.48
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1060.61
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-134.134.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.61
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.61.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1029.30
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1057.58
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1060.64
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1032.33
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1026.30
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2049.50
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1055.56
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1060.63+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1062.69+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-134.134+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1063.69+fips1
Configuration
Allow /smack/doi to remain unconfigured by using CIPSO_V4_DOI_UNKNOWN(0) when no DOI is configured.
Smack /smack/doi = CIPSO_V4_DOI_UNKNOWN(0)
Operational
Clear decommissioned DOI definitions, serialize concurrent DOI updates with a lock, and add the new DOI before removing the old default map so the old map remains if adding the new map fails.

Event History

May 27, 2026

CVE Published

via MITRE·12:14 PM

Data Sourced

via MITRE·12:14 PM

Description

Data Sourced

via NVD·02:16 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

Which systems and users are exposed?

Exposure is limited to Linux systems using Smack where a local user with low privileges can write to /smack/doi. The issue affects networking for non-ambient Smack labels; no user interaction is required.

What is the practical impact after exploitation?

Reusing a DOI value that was written previously can disable networking for processes running with non-ambient labels. The supplied example shows subsequent network attempts failing with an address-family error.

How can administrators identify a suspected occurrence?

Kernel messages may show CIPSO removal and addition failures, including "remove rc = -2" and "cipso add rc = -17", after writes to /smack/doi. Affected non-ambient-labeled processes may then be unable to communicate over the network while the ambient label remains able to do so.

CVE-2025-71304: smack: /smack/doi: accept previously used values

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems and users are exposed?

What is the practical impact after exploitation?

How can administrators identify a suspected occurrence?

Company

Resources

Contact