SB20260816348 - Improper access control in Linux kernel landlock

Description

This security bulletin contains information about 1 vulnerability.

1) Improper access control (CVE-ID: CVE-2026-72183)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass signal restrictions and send signals to processes outside its Landlock domain.

The vulnerability exists due to improper access control in the Landlock SIGIO delivery path when handling asynchronous SIGIO delivery for process-group file or socket owners. A local user can configure a file or socket owner with crafted fcntl settings to signal an entire process group to bypass signal restrictions and send signals to processes outside its Landlock domain.

Exploitation requires a sandboxed process that owns a file or socket and can trigger SIGIO delivery to a process group that includes an out-of-domain process such as a supervisor or security monitor.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/04916f7dc6d37cd478b06c86398c34a6963ac8c9
• https://git.kernel.org/stable/c/1f18aac2637220b5847d073447498e81ddca10b2
• https://git.kernel.org/stable/c/4b80320ca7ed03d6e683f95b6066565dc97b9f92
• https://git.kernel.org/stable/c/7a92e9fd1d496a610b40e0c4253fd54e7496f5ab