CVE-2026-75037: LACT Authentication Bypass Vulnerability

CVE-2026-75037 Overview

CVE-2026-75037 is an authentication bypass vulnerability in Linux AMDGPU Controller (LACT), a GUI tool used to configure AMD GPUs on Linux. The flaw stems from LACT relying on Polkit authentication based on UnixProcessSubject and peer process IDs (PIDs). This design allows a local attacker to bypass Polkit authorization checks and invoke privileged operations exposed by the LACT daemon. The issue affects LACT through version 0.10.0 and is fixed by commit d0478fe42c2219454e272f96b1cbd29ab37ee566. The weakness maps to CWE-290: Authentication Bypass by Spoofing.

Critical Impact
A local, low-privileged user can bypass Polkit authentication and gain the ability to execute privileged GPU configuration operations, resulting in high impact to confidentiality, integrity, and availability on the affected host.

Affected Products

LACT (Linux AMDGPU Controller) versions up to and including 0.10.0
Linux distributions packaging vulnerable LACT builds, including SUSE (tracked in SUSE Bug #1276480)
Systems where the LACT daemon is installed and accessible to local users

Discovery Timeline

2026-08-25 - CVE-2026-75037 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-75037

Vulnerability Analysis

LACT exposes privileged GPU management functionality through a system daemon that clients contact over an inter-process communication channel. The daemon uses Polkit to decide whether a caller is authorized to invoke privileged actions. LACT identifies the caller using a UnixProcessSubject, which references the client by its PID and process start time. This subject type is documented by Polkit as unsafe for authorization decisions because PIDs are recyclable and race-prone.

A local attacker can exploit the gap between when the daemon reads the caller's PID and when Polkit resolves that PID back to a user. By racing execve boundaries or triggering PID reuse, an attacker can present a benign or authorized identity to Polkit while executing arbitrary privileged actions through LACT.

Root Cause

The root cause is the use of process-identifier based subjects for authorization. Polkit exposes UnixProcessSubject and the safer SystemBusNameSubject. The former is vulnerable to time-of-check to time-of-use (TOCTOU) races because process attributes are looked up asynchronously from /proc. LACT selected the process-based path, so the identity established during authorization does not reliably match the identity that later invokes the action.

Attack Vector

Exploitation requires local access and low privileges. The attacker sends a request to the LACT daemon and manipulates process state so that the PID inspected by Polkit resolves to a privileged or trusted identity, while the actual request originates from the attacker. Successful exploitation grants control over GPU configuration operations that require administrative rights, including operations that can alter kernel-visible device state on the host. Attack complexity is high because it requires winning a race window, but no user interaction is needed. Technical details are tracked in the upstream project repository at LACT on GitHub and in SUSE Bug #1276480.

Detection Methods for CVE-2026-75037

Indicators of Compromise

Unexpected invocations of the LACT daemon from non-administrative user sessions on Linux hosts.
Polkit authorization decisions logged for LACT actions where the resolved subject does not match the originating shell or session user.
Anomalous changes to AMD GPU configuration (clock, power, fan curves) applied outside of a scheduled administrative window.

Detection Strategies

Audit Polkit log entries under /var/log/auth.log or journalctl -u polkit for LACT-related actions and correlate the recorded PID with process accounting data.
Monitor D-Bus traffic to the LACT service for calls originating from short-lived processes that exit before the authorization completes.
Track installations of LACT 0.10.0 or earlier across managed Linux endpoints using package inventory queries.

Monitoring Recommendations

Enable Linux auditd rules for execve events by processes that subsequently contact the LACT D-Bus service.
Alert on privileged GPU configuration changes performed by non-administrator UIDs.
Baseline expected users of LACT on workstations and flag deviations for review.

How to Mitigate CVE-2026-75037

Immediate Actions Required

Upgrade LACT to a release that includes commit d0478fe42c2219454e272f96b1cbd29ab37ee566 or later.
Restrict LACT installation to systems where local users are trusted to hold administrative privileges.
Review Polkit rules for any custom actions that rely on UnixProcessSubject and migrate them to SystemBusNameSubject.

Patch Information

The upstream fix is available in the LACT GitHub repository as commit d0478fe42c2219454e272f96b1cbd29ab37ee566. The patch replaces PID-based subject handling with a bus-name based subject, which Polkit resolves atomically and is not susceptible to PID reuse. Distribution-specific tracking is available in SUSE Bug #1276480. Administrators should confirm their packaged version includes the fix before returning affected systems to normal operation.

Workarounds

Stop and disable the LACT daemon on hosts that do not require GPU tuning, using systemctl disable --now lactd.
Remove the LACT package from multi-user systems until a patched version is deployed.
Constrain access to the LACT D-Bus interface with local Polkit policy overrides that require administrator authentication for every action.

bash

# Configuration example
# Disable and mask the LACT daemon on affected hosts until patched
sudo systemctl stop lactd
sudo systemctl disable lactd
sudo systemctl mask lactd

# Verify installed LACT version
lact --version