Improper access control in Linux kernel - CVE-2026-72183
Published: August 16, 2026
Vulnerability identifier: #VU143412
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-72183
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to bypass signal restrictions and send signals to processes outside its Landlock domain.
The vulnerability exists due to improper access control in the Landlock SIGIO delivery path when handling asynchronous SIGIO delivery for process-group file or socket owners. A local user can configure a file or socket owner with crafted fcntl settings to signal an entire process group to bypass signal restrictions and send signals to processes outside its Landlock domain.
Exploitation requires a sandboxed process that owns a file or socket and can trigger SIGIO delivery to a process group that includes an out-of-domain process such as a supervisor or security monitor.
Affected software
Linux kernel
How to mitigate CVE-2026-72183
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3