Exposure of Resource to Wrong Sphere in Linux kernel - CVE-2026-93222
Published: September 25, 2026
Vulnerability identifier: #VU152176
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-93222
CWE-ID: CWE-668
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause signal sender identifiers to be incorrectly rewritten.
The vulnerability exists due to improper handling of shared siginfo data in the signal delivery logic when delivering group signals across namespaces. A local user can send a group signal to cause sender identifiers rewritten for one recipient to affect subsequent recipients.
Affected software
Linux kernel
How to mitigate CVE-2026-93222
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/03c8761e75d1619906bb503686f9cc1dfc6a67f4
- https://git.kernel.org/stable/c/148b0dae2a1755beb873a2aab51fb191414f068c
- https://git.kernel.org/stable/c/4ee7c4e4719a825052f42f02ec159b5b42b68fbc
- https://git.kernel.org/stable/c/6b1de022304ef85284c5933a5fb8492f6f54efc9
- https://git.kernel.org/stable/c/a246da20c8e4ae4319511c698b9f26ad0ad1769f
- https://git.kernel.org/stable/c/b655c2040ce836afad5643842543567b31f8c11d
- https://git.kernel.org/stable/c/d19cdc167e696714509e87d3f7ae765b6e164589
- https://git.kernel.org/stable/c/e015d1ac6b43a23c52c5163299414ae77d7d4ae0