Executive brief
A vulnerability in the Linux kernel's Smack security module can cause network connectivity to fail for certain applications. When specific security configuration values are reused, the system fails to properly update its internal network mapping, leading to a denial of service for network traffic. This primarily affects systems using Smack for mandatory access control and could disrupt business operations or services relying on secure network communication.
Technical details
A vulnerability exists in the Smack LSM's handling of the /smack/doi interface. When a previously used DOI value is rewritten to the interface, Smack fails to re-add the decommissioned DOI to the NetLabel configuration. This failure prevents the addition of the 'default' domain map for IPv4, effectively disabling networking for processes with non-ambient Smack labels. The root cause is the lack of proper cleanup for decommissioned DOI definitions and missing serialization for concurrent updates. The fix introduces a new mutex lock (smk_cipso_doi_lock) and ensures decommissioned DOIs are cleared before re-adding them.
Affected products
- Linux Linux kernel All versions prior to the fix in 2025/2026
Timeline
- 2025-09-30: other: Patch authored
- 2026-03-04: patched: Patch committed to stable tree
- 2026-05-27: advisory: CVE published
References
- https://git.kernel.org/stable/c/199452f22d2f74b897fe826f81ec402b0a8461a0
- https://git.kernel.org/stable/c/1c7ee23dfcd18d80770d8f90f2ab5bb1b2bfd8a3
- https://git.kernel.org/stable/c/33d589ed60ae433b483761987b85e0d24e54584e
- https://git.kernel.org/stable/c/5a247a84de0ba44edbbd6be851c8a6b2aa60ff85
- https://git.kernel.org/stable/c/6ec091c5c7eeabd249a7c46813cad1e9f555f859
- https://git.kernel.org/stable/c/8beebb8ad9a003f978e53b06237986588223e15e
- https://git.kernel.org/stable/c/eb718a3c8181ada679340db34cd61bce48e44749