CVE-2026-80928: smack: fix cred UAF in smack_file_send_sigiotask()
In the Linux kernel, the following vulnerability has been resolved:
smack: fix cred UAF in smackfilesendsigiotask()
When inspecting the credentials of another task, objective credentials (->realcred, accessed with taskcred()) must always be used.
Accessing ->cred on a non-current task is forbidden unless that task is being created or destroyed; a task is allowed to change its own ->cred pointer with no synchronization, and changing ->cred should only affect the current syscall.
smackfilesendsigiotask() was accessing both sets of credentials: First tsk->cred, then taskcred(tsk).
Fix it, always access the objective credentials here.
I have tested that this bug can lead to a KASAN-reported UAF of struct cred in smackfilesendsigiotask(), and that this fix prevents the race.
Event History
Frequently Asked Questions
What conditions are needed to trigger the use-after-free?
The race occurs when smack_file_send_sigiotask() inspects credentials of another task while that task changes its own credential pointer. The vulnerable path accessed tsk->cred on a non-current task without the required synchronization.
What is the impact demonstrated for this issue?
Testing demonstrated a KASAN-reported use-after-free of struct cred in smack_file_send_sigiotask(). The provided data does not establish a demonstrated privilege-escalation or code-execution outcome.
How can I determine whether a fix is present?
A fixed kernel version will make smack_file_send_sigiotask() consistently obtain the target task's objective credentials via __task_cred(tsk), rather than first accessing tsk->cred. The listed stable kernel references identify commits containing the correction.