{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-93191", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-17T16:02:15.092Z", "datePublished": "2026-09-17T16:12:15.765Z", "dateUpdated": "2026-10-19T09:07:03.807Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:07:03.807Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmack: fix incorrect task context in smack_msg_queue_msgrcv\n\nThe smack_msg_queue_msgrcv() function incorrectly checks\nthe permissions of the 'current' task instead of the\n'target' task.\n\nIn the msgsnd() syscall path, if a receiver is already waiting,\nthe pipelined_send() optimization is used to push the message\ndirectly to the receiver task:\n\n ipc/msg.c`pipelined_send():\n ` smp_store_release(&msr->r_msg, msg)\n\nIn this case, the 'sender' (current) task performs the check\non behalf of the 'receiver' task (msr->r_tsk, passed as the\n'target' parameter):\n\n ipc/msg.c`pipelined_send():\n ` security_msg_queue_msgrcv(,, target := msr->r_tsk,,)\n\nHowever, smack_msg_queue_msgrcv() ignores the 'target' and\nchecks 'current':\n\n smack_msg_queue_msgrcv(…)\n ` smk_curacc_msq(isp, MAY_READWRITE); // current task\n\n'current' MAY satisfy smack_msg_queue_msgrcv r/w requirement,\nbut 'target' (the receiver task) might NOT;\nas a result, an unauthorized receiver gets the message,\nviolating MAC policy.\n\nTest:\n1) create a sysv message queue with label “foo”\n2) echo \"bar foo r\" >/smack/load2\n3) msgrcv(,,,0,MSG_NOERROR) in \"bar\"-labeled task.\n The task is waiting for the messages ...\n4) msgsnd() from a \"foo\"-labeled task:\n\"bar\"-labeled task gets the message.\n\nThis patch fixes the issue by checking permission on the\n'target' task instead of 'current'.\n\n(2008-02-04, Casey Schaufler)" } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "security/smack/smack_lsm.c" ], "versions": [ { "version": "e114e473771c848c3cfec05f0123e70f1cdbdc99", "lessThan": "4e49f997ef0c569e09b42aab6bd38c7c54ea095d", "status": "affected", "versionType": "git" }, { "version": "e114e473771c848c3cfec05f0123e70f1cdbdc99", "lessThan": "dbece6c2f80b0470d8d99d7a016827dce99ed6e3", "status": "affected", "versionType": "git" }, { "version": "e114e473771c848c3cfec05f0123e70f1cdbdc99", "lessThan": "7be4bd21c50afa83c93799b0f16cf5bfa493194e", "status": "affected", "versionType": "git" }, { "version": "e114e473771c848c3cfec05f0123e70f1cdbdc99", "lessThan": "ec47f4177046dfaaf1cebb15f4d2e7b543475daf", "status": "affected", "versionType": "git" }, { "version": "e114e473771c848c3cfec05f0123e70f1cdbdc99", "lessThan": "e35dc5a4ed6d1e536382d80c685187511ff248a1", "status": "affected", "versionType": "git" }, { "version": "e114e473771c848c3cfec05f0123e70f1cdbdc99", "lessThan": "c2ab27c2e11591524b1378c24ad18882a425d1fa", "status": "affected", "versionType": "git" }, { "version": "e114e473771c848c3cfec05f0123e70f1cdbdc99", "lessThan": "d02c55e3ea82e41ea2c2026e08201e5daa4d0cfe", "status": "affected", "versionType": "git" }, { "version": "e114e473771c848c3cfec05f0123e70f1cdbdc99", "lessThan": "fba3d32825f4bbc8e20f0cdc3b14df57965b8fe5", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "security/smack/smack_lsm.c" ], "versions": [ { "version": "2.6.25", "status": "affected" }, { "version": "0", "lessThan": "2.6.25", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.270", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.221", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.52", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "5.10.270" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "5.15.221" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.1.188" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.6.157" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.12.110" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "6.18.52" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "7.2.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.25", "versionEndExcluding": "7.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/4e49f997ef0c569e09b42aab6bd38c7c54ea095d" }, { "url": "https://git.kernel.org/stable/c/dbece6c2f80b0470d8d99d7a016827dce99ed6e3" }, { "url": "https://git.kernel.org/stable/c/7be4bd21c50afa83c93799b0f16cf5bfa493194e" }, { "url": "https://git.kernel.org/stable/c/ec47f4177046dfaaf1cebb15f4d2e7b543475daf" }, { "url": "https://git.kernel.org/stable/c/e35dc5a4ed6d1e536382d80c685187511ff248a1" }, { "url": "https://git.kernel.org/stable/c/c2ab27c2e11591524b1378c24ad18882a425d1fa" }, { "url": "https://git.kernel.org/stable/c/d02c55e3ea82e41ea2c2026e08201e5daa4d0cfe" }, { "url": "https://git.kernel.org/stable/c/fba3d32825f4bbc8e20f0cdc3b14df57965b8fe5" } ], "title": "smack: fix incorrect task context in smack_msg_queue_msgrcv", "x_generator": { "engine": "bippy-1.2.0" } } } }