Executive brief
The Linux kernel's SMACK (Simplified Mandatory Access Control) security module incorrectly validates permissions when receiving System V IPC messages. A sender can bypass the receiver's access control checks by exploiting an optimization path, allowing an unauthorized process to receive messages intended for restricted access levels. This violates the mandatory access control policy and can lead to information disclosure to processes that should not have access.
Technical details
The vulnerability is a logic error in the smack_msg_queue_msgrcv() function in security/smack/smack_lsm.c. When the msgsnd() syscall uses the pipelined_send() optimization to deliver a message directly to a waiting receiver, the security module receives a 'target' task parameter but incorrectly checks the sender's ('current') task context instead. This allows a process with the correct sender credentials but lacking receiver permissions to bypass receiver checks via the optimization path. An attacker can create a message queue, set up a receiver task with restricted labels, send a message from a permitted sender, and the restricted receiver will receive the message despite failing the security policy check. The fix changes smk_curacc_msq() to smk_tskacc_msq() and verifies the target task's access instead of current.
Affected products
- Linux Linux kernel all versions with SMACK enabled (prior to fix commit fba3d32825f4bbc8e20f0cdc3b14df57965b8fe5)
Timeline
- 2026-09-17: disclosed: CVE-2026-93191 published
- 2026-09-14: patched: Fix committed upstream as fba3d32825f4bbc8e20f0cdc3b14df57965b8fe5