CVE-2026-75038: LACT Symlink Following DoS Vulnerability

CVE-2026-75038 Overview

CVE-2026-75038 is a symlink following vulnerability in ilya-zlobintsev/LACT, the Linux AMDGPU Controller utility. The flaw affects LACT versions through 0.10.0 and allows a local attacker with low privileges to trigger a denial-of-service condition. The vulnerability is classified under CWE-61: UNIX Symbolic Link (Symlink) Following. LACT runs a privileged daemon to configure GPU parameters, which processes file paths that may resolve through attacker-controlled symbolic links. An unprivileged user can abuse this trust boundary to cause the daemon to operate on unintended files.

Critical Impact
A local, low-privileged user can trigger denial-of-service by planting symbolic links that the LACT daemon follows during privileged file operations.

Affected Products

ilya-zlobintsev/LACT (Linux AMDGPU Controller) through version 0.10.0
Linux distributions packaging LACT <= 0.10.0, including openSUSE (tracked in SUSE Bugzilla #1276481)
Systems running the LACT daemon with elevated privileges

Discovery Timeline

2026-08-25 - CVE-2026-75038 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-75038

Vulnerability Analysis

LACT provides a graphical and command-line interface for controlling AMD GPU parameters on Linux. It relies on a privileged daemon component that reads from and writes to files on behalf of the requesting user. The daemon does not adequately validate whether target paths are regular files or attacker-controlled symbolic links before dereferencing them. A local attacker who can write to a predictable path used by LACT can plant a symlink pointing to arbitrary locations on the filesystem. When the LACT daemon subsequently performs a file operation, it follows the symlink and acts on the target. This can corrupt state files, exhaust I/O resources, or crash the daemon, producing a denial-of-service condition.

Root Cause

The root cause is missing symlink validation before privileged file operations. The daemon opens or writes paths without using symlink-safe primitives such as O_NOFOLLOW, openat2 with RESOLVE_NO_SYMLINKS, or explicit lstat checks. Under [CWE-61], any process that follows attacker-controlled links across a privilege boundary inherits the attacker's intent for the resulting file operation.

Attack Vector

Exploitation requires local access and low privileges. The attacker plants a symbolic link at a path the LACT daemon reads or writes. When the daemon performs its scheduled or triggered file operation, it follows the link and acts on the target file. Because the daemon runs with elevated permissions, the resulting write or truncation can affect files the attacker could not otherwise modify, ultimately disrupting availability. Refer to the GitHub repository for LACT and the SUSE Bug Report #1276481 for technical context; no verified public exploit code is available at this time.

Detection Methods for CVE-2026-75038

Indicators of Compromise

Unexpected symbolic links residing in directories accessed by the LACT daemon, such as configuration or runtime state paths under /etc/lact or /var/lib/lact.
LACT daemon crashes, restarts, or systemd unit failures recorded in journalctl -u lactd.
File writes performed by the LACT daemon to targets outside its expected working set.

Detection Strategies

Audit filesystem operations from the LACT daemon process using auditd rules on openat, open, and unlink syscalls.
Alert on symlink creation in directories owned or accessed by privileged services.
Compare installed LACT package versions against 0.10.0 and flag hosts running affected releases.

Monitoring Recommendations

Forward auditd and systemd-journald logs to a centralized analytics platform for correlation across hosts.
Monitor for anomalous crash loops on the lactd service unit.
Track user activity in directories used by LACT to identify pre-positioning of malicious symlinks.

How to Mitigate CVE-2026-75038

Immediate Actions Required

Inventory Linux hosts running LACT and identify installations at version 0.10.0 or earlier.
Restrict access to directories used by the LACT daemon so unprivileged users cannot create symlinks within them.
Disable or stop the LACT daemon on multi-user systems until a fixed release is deployed.

Patch Information

At the time of publication, refer to the upstream ilya-zlobintsev/LACT GitHub repository for the latest release addressing the symlink following issue. Distribution-specific tracking is available in SUSE Bug Report #1276481. Upgrade to a version later than 0.10.0 once released and validated by your distribution.

Workarounds

Limit LACT installation to single-user workstations where local privilege boundaries are less relevant.
Set restrictive permissions (0700) on LACT runtime and configuration directories to prevent symlink planting by other local accounts.
Consider running the LACT daemon under a dedicated, sandboxed systemd unit with ProtectSystem=strict and NoNewPrivileges=true.

bash

# Configuration example: harden the LACT systemd service against symlink attacks
sudo systemctl edit lactd.service

# Add the following override:
[Service]
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/lact /etc/lact
RestrictSUIDSGID=true

sudo systemctl daemon-reload
sudo systemctl restart lactd.service