CVE-2026-80928: Linux Kernel Smack Use-After-Free Vulnerability

CVE-2026-80928 Overview

CVE-2026-80928 is a use-after-free (UAF) vulnerability in the Linux kernel's Smack Linux Security Module (LSM). The flaw resides in smack_file_send_sigiotask(), which incorrectly accessed a task's subjective credentials (->cred) when it should have used the objective credentials (->real_cred) via __task_cred(). Because a task may change its own ->cred pointer without synchronization, a race condition allows freed struct cred memory to be dereferenced. The issue has been confirmed via KASAN reports and is fixed upstream.

Critical Impact
A local, low-privileged attacker can trigger a use-after-free on struct cred in the kernel, potentially leading to privilege escalation or kernel memory corruption.

Affected Products

Linux kernel builds with the Smack LSM enabled (CONFIG_SECURITY_SMACK)
Multiple stable kernel branches prior to the fix (see referenced commits)
Linux distributions shipping Smack-enabled kernels (e.g., Tizen, hardened server builds)

Discovery Timeline

2026-09-11 - CVE-2026-80928 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80928

Vulnerability Analysis

The Smack LSM enforces mandatory access control decisions when signals are delivered via asynchronous I/O notifications. The hook smack_file_send_sigiotask() inspects the target task's credentials to determine whether the signal delivery is permitted.

The defective code path accessed tsk->cred directly before subsequently reading __task_cred(tsk). The Linux kernel credential model requires that inspection of another task's credentials use only the objective credentials pointer ->real_cred, obtained through __task_cred(). The subjective ->cred pointer belongs to the task itself and may be replaced during a syscall without any locking visible to observers.

When the target task swaps or releases its ->cred concurrently, the Smack hook holds a stale pointer to a freed struct cred. Dereferencing that pointer produces the reported KASAN use-after-free.

Root Cause

The root cause is misuse of the credential API in smack_file_send_sigiotask(). Accessing tsk->cred on a non-current task violates the kernel's credential access contract. The fix consistently uses __task_cred(tsk) to read the objective credentials, eliminating the race window.

Attack Vector

Exploitation requires local access and low privileges. An attacker races two threads: one that owns a file with F_SETOWN/fcntl configured to send SIGIO, and another that mutates credentials via calls such as setuid() or execve(). Triggering signal-driven I/O while the target's credentials are being replaced produces the UAF, which can be leveraged for kernel memory corruption or escalation to root.

No public proof-of-concept exploit is available. Technical details of the fix are documented in the upstream kernel commits, including Kernel Commit b791401b and Kernel Commit fedc88e3.

Detection Methods for CVE-2026-80928

Indicators of Compromise

KASAN reports in dmesg identifying a use-after-free in smack_file_send_sigiotask or smk_access.
Unexpected kernel oops or panic messages referencing struct cred when Smack is active.
Anomalous SIGIO delivery patterns from processes rapidly changing credentials with setuid() or execve().

Detection Strategies

Enable KASAN in test and pre-production kernels to surface the UAF before deployment.
Audit installed kernel packages against distribution advisories for backported fixes referencing the commits listed in this CVE.
Correlate kernel crash telemetry with processes using asynchronous I/O signal ownership (fcntl(F_SETOWN)).

Monitoring Recommendations

Forward kern.log, journalctl -k, and crash dumps to a centralized log platform for anomaly detection.
Monitor for kernel oops events and repeated crashes of the same user session, which may indicate exploitation attempts.
Track privileged syscall activity from unprivileged users, particularly rapid setuid()/fcntl(F_SETOWN) sequences.

How to Mitigate CVE-2026-80928

Immediate Actions Required

Apply vendor-supplied kernel updates that incorporate the upstream Smack credential fix.
Reboot systems after patching, since kernel updates do not take effect until the new image is loaded.
Inventory all hosts with CONFIG_SECURITY_SMACK=y and prioritize them for patching.

Patch Information

The fix has been merged across multiple stable branches. Refer to the upstream commits: Kernel Commit 7c7fe043, Kernel Commit a512366d, Kernel Commit b5bcf3ad, Kernel Commit b791401b, Kernel Commit ed64aa50, Kernel Commit f9c7b1f2, and Kernel Commit fedc88e3. Consult your distribution's security advisories for backported package versions.

Workarounds

If Smack is not required, disable the LSM by removing smack from the lsm= boot parameter and rebooting.
Restrict local shell access to trusted users to reduce the pool of potential attackers.
Enforce process resource limits and seccomp profiles to constrain the syscalls needed to race credential updates.

bash

# Verify running kernel and Smack configuration
uname -r
zgrep CONFIG_SECURITY_SMACK /proc/config.gz 2>/dev/null || \
  grep CONFIG_SECURITY_SMACK /boot/config-$(uname -r)

# Check active LSMs; if Smack is not required, remove from boot line
cat /sys/kernel/security/lsm