CVE-2026-80928

The Linux kernel's Smack security module contains a use-after-free of the kernel credential structure (struct cred) in smack_file_send_sigiotask(), the hook invoked when a file delivers a SIGIO signal to its owner task. The function incorrectly read the target task's subjective credentials (tsk->cred) in addition to the objective credentials (__task_cred(tsk)); because a task may swap its own ->cred pointer without synchronization (e.g., during a setuid-style credential change), a racing reader can dereference a freed credential object. A local attacker able to trigger repeated SIGIO delivery against a task that is concurrently changing credentials could exploit the race, and the fix author confirmed it is reachable via a KASAN-reported use-after-free, with CVSS 3.1 rating high (7.8, local vector, low privileges required, high confidentiality/integrity/availability impact). Only systems with the Smack LSM compiled in and enabled (CONFIG_SECURITY_SMACK) are affected — Smack is not enabled by default in mainstream distributions. No public proof of concept is known, the flaw is not in the CISA KEV catalog, and there is no indication of in-the-wild exploitation.

What to do: Apply kernel updates from your distribution once the fix is backported, and verify whether Smack is actually in use (check CONFIG_SECURITY_SMACK and your lsm= boot parameter) — systems without Smack enabled are not exposed. If Smack is not required, disable it at boot or in the kernel config to eliminate exposure. Watch kernel logs for KASAN or slab use-after-free reports involving struct cred as an indicator of attempted triggering.