Executive Summary

The CVE-2026-80928 flaw in the Linux kernel’s SMACK module allowed a use‑after‑free (UAF) of a task’s credentials during the smack_file_send_sigiotask() syscall. By accessing both the current and objective credential structures, an attacker could trigger a KASAN‑reported UAF, potentially leading to kernel memory corruption or privilege escalation. The patch enforces the use of objective credentials only, eliminating the race and preventing the UAF.

---

Authoritative CVE Metadata - CVSS Base Score: 7.8 (HIGH) - Published: 2026-09-11T20:18:56.513 - Last Modified: 2026-09-13T07:17:00.527

Original Description: In the Linux kernel, the following vulnerability has been resolved:

smack: fix cred UAF in smack_file_send_sigiotask()

When inspecting the credentials of another task, objective credentials (->real_cred, accessed with __task_cred()) must always be used.

Accessing ->cred on a non-current task is forbidden unless that task is being created or destroyed; a task is allowed to change its own ->cred pointer with no synchronization, and changing ->cred should only affect the current syscall.

smack_file_send_sigiotask() was accessing both sets of credentials: First tsk->cred, then __task_cred(tsk).

Fix it, always access the objective credentials here.

I have tested that this bug can lead to a KASAN-reported UAF of struct cred in smack_file_send_sigiotask(), and that this fix prevents the race.

"Experience is simply the name we give our mistakes."

— Oscar Wilde