{"id":"CVE-2026-80928","title":"smack: fix cred UAF in smack_file_send_sigiotask()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmack: fix cred UAF in smack_file_send_sigiotask()\n\nWhen inspecting the credentials of another task, objective credentials\n(->real_cred, accessed with __task_cred()) mu…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-825"],"vendor":"Linux","product":"Linux","affected":["Linux >= 3b11a1decef07c19443d24ae926982bc8ec9f4c0 < a512366d84e134a9eefc2cc40eeb6e80e2ec162c","Linux >= 3b11a1decef07c19443d24ae926982bc8ec9f4c0 < 7c7fe043f3099d0d35002b248967f75e55345b93","Linux >= 3b11a1decef07c19443d24ae926982bc8ec9f4c0 < f9c7b1f2b9d8f4176d2632743f51400855978ace","Linux >= 3b11a1decef07c19443d24ae926982bc8ec9f4c0 < b5bcf3adfa27279da4401ab8f1e1a706601a92be","Linux >= 3b11a1decef07c19443d24ae926982bc8ec9f4c0 < ed64aa505875a3b4defd504ee8e59e1949246a62","Linux >= 3b11a1decef07c19443d24ae926982bc8ec9f4c0 < b791401bf389a1546a830d2b381ca60fe94c7870","Linux >= 3b11a1decef07c19443d24ae926982bc8ec9f4c0 < fedc88e38ce979a720cd2de042578cb5df3dc8de","Linux 2.6.29"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:45:12.134Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80928","references":[{"url":"https://git.kernel.org/stable/c/a512366d84e134a9eefc2cc40eeb6e80e2ec162c"},{"url":"https://git.kernel.org/stable/c/7c7fe043f3099d0d35002b248967f75e55345b93"},{"url":"https://git.kernel.org/stable/c/f9c7b1f2b9d8f4176d2632743f51400855978ace"},{"url":"https://git.kernel.org/stable/c/b5bcf3adfa27279da4401ab8f1e1a706601a92be"},{"url":"https://git.kernel.org/stable/c/ed64aa505875a3b4defd504ee8e59e1949246a62"},{"url":"https://git.kernel.org/stable/c/b791401bf389a1546a830d2b381ca60fe94c7870"},{"url":"https://git.kernel.org/stable/c/fedc88e38ce979a720cd2de042578cb5df3dc8de"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80928.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-80928"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532381"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80928"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80928"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80928.mbox"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00129,"epssPercentile":0.02535,"scores":{"cna":7.8,"vendor":5.5},"ingestedAt":"2026-09-14T15:23:07.455Z","slug":"CVE-2026-80928","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsmack: fix cred UAF in smack_file_send_sigiotask()\n\nWhen inspecting the credentials of another task, objective credentials\n(->real_cred, accessed with __task_cred()) must always be used.\n\nAccessing ->cred on a non-current task is forbidden unless that task is\nbeing created or destroyed; a task is allowed to change its own ->cred\npointer with no synchronization, and changing ->cred should only affect the\ncurrent syscall.\n\nsmack_file_send_sigiotask() was accessing both sets of credentials: First\ntsk->cred, then __task_cred(tsk).\n\nFix it, always access the objective credentials here.\n\nI have tested that this bug can lead to a KASAN-reported UAF of struct cred\nin smack_file_send_sigiotask(), and that this fix prevents the race.\n\n## Affected\n\n- `Linux >= 3b11a1decef07c19443d24ae926982bc8ec9f4c0 < a512366d84e134a9eefc2cc40eeb6e80e2ec162c`\n- `Linux >= 3b11a1decef07c19443d24ae926982bc8ec9f4c0 < 7c7fe043f3099d0d35002b248967f75e55345b93`\n- `Linux >= 3b11a1decef07c19443d24ae926982bc8ec9f4c0 < f9c7b1f2b9d8f4176d2632743f51400855978ace`\n- `Linux >= 3b11a1decef07c19443d24ae926982bc8ec9f4c0 < b5bcf3adfa27279da4401ab8f1e1a706601a92be`\n- `Linux >= 3b11a1decef07c19443d24ae926982bc8ec9f4c0 < ed64aa505875a3b4defd504ee8e59e1949246a62`\n- `Linux >= 3b11a1decef07c19443d24ae926982bc8ec9f4c0 < b791401bf389a1546a830d2b381ca60fe94c7870`\n- `Linux >= 3b11a1decef07c19443d24ae926982bc8ec9f4c0 < fedc88e38ce979a720cd2de042578cb5df3dc8de`\n- `Linux 2.6.29`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80928.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":224829,"id":"CVE-2026-80928","ts":1792401567180,"field":"cvss","old":"5.5","new":"7.8"},{"seq":224828,"id":"CVE-2026-80928","ts":1792401567180,"field":"severity","old":"medium","new":"high"},{"seq":202779,"id":"CVE-2026-80928","ts":1789403715875,"field":"cvss","old":"7.8","new":"5.5"},{"seq":202778,"id":"CVE-2026-80928","ts":1789403715875,"field":"severity","old":"high","new":"medium"},{"seq":183635,"id":"CVE-2026-80928","ts":1789356676199,"field":"cvss","old":"7.8","new":"7"},{"seq":153108,"id":"CVE-2026-80928","ts":1789285349037,"field":"cvss","old":null,"new":"7.8"},{"seq":153107,"id":"CVE-2026-80928","ts":1789285349037,"field":"severity","old":"none","new":"high"},{"seq":147301,"id":"CVE-2026-80928","ts":1789270208223,"field":"cvss","old":null,"new":"7"},{"seq":147300,"id":"CVE-2026-80928","ts":1789270208223,"field":"severity","old":"none","new":"high"},{"seq":109052,"id":"CVE-2026-80928","ts":1789183730120,"field":"cvss","old":null,"new":"7"},{"seq":109051,"id":"CVE-2026-80928","ts":1789183730120,"field":"severity","old":"none","new":"high"}]}