CVE-2026-93191
UnknownSummary
In the Linux kernel, smack_msg_queue_msgrcv() incorrectly checks permissions of the 'current' task instead of the 'target' task. In the pipelined_send() optimization path, the sender checks on behalf of the receiver, so an unauthorized receiver can get the message, violating Smack MAC policy. The fix checks permissions on the 'target' task.
Risk Assessment
A Smack MAC policy violation allows an unauthorized receiver to obtain messages from a SysV queue, potentially leaking information between labels. It affects systems with Smack LSM enabled.
Recommendation
Update the Linux kernel to a version containing the fix that checks permissions on the 'target' task in smack_msg_queue_msgrcv().
Other vulnerabilities in Linux kernel
See all- CVE-2026-93204Unknown
In the Linux kernel, the batman-adv module's dat handling updated MAC addresses using a simple copy, which could be partially observed by parallel readers. A reader might transport a half-updated MAC address over the network or use it in ARP responses, poisoning the ARP cache. The fix uses atomic64_t to store the 48-bit MAC address, ensuring readers see either the old or new address, never a mixture.
- CVE-2026-93202Unknown
A bug in the Linux kernel's I3C subsystem causes recursive locking during registration of new I3C devices. The function i3c_master_register_new_i3c_devs() registers devices while holding i3c_bus_normaluse_lock(), and device_register() can immediately trigger a probe callback that tries to acquire the same lock again, leading to a deadlock. The fix separates device creation from registration and uses the maintenance lock.
- CVE-2026-93200Unknown
The Linux kernel's i3c master subsystem had a use-after-free vulnerability in the master->this pointer. Sysfs attribute callbacks dereferenced master->this, which was freed in i3c_master_detach_free_devs() before the master device was released. The fix keeps master->this alive until i3c_masterdev_release() and resets it on error paths.
- CVE-2026-93199Unknown
In the Linux kernel, the i3c_master_search_i3c_dev_duplicate() function that searches for duplicate I3C devices can incorrectly match the master device itself (master->this), returning the controller as a duplicate. Since the controller is not a target device, it cannot be a duplicate of one. The fix excludes master->this from matching.
- CVE-2026-93198Unknown
In the Linux kernel, the dm-pcache module does not validate the persisted dirty_tail chain at load. A crafted image, whose on-media fields are authenticated only by a crc32c with a fixed seed, can aim dirty_tail at a chain of last ksets that never terminates, causing cache_writeback_fn() to re-arm itself forever. The fix adds validation of the dirty_tail chain at load with a hop cap.
- CVE-2026-93197Unknown
A bug in the Linux kernel's memcg subsystem causes LRU size accounting to be copied to the parent instead of moved when a memory cgroup is offlined, leaving stale counters on the child. This makes the LRU (or MGLRU) scanner read phantom sizes and grind through empty lists on dying cgroups, over-budgeting limits and wasting CPU. On one host, counters described 476 GiB of pages—1.89x the machine's RAM.
- CVE-2026-93195Unknown
In the Linux kernel, the drm/bridge synopsys dw-dp driver initializes and registers the DisplayPort AUX channel during dw_dp_bind(), but never unregisters it. This may lead to resource leaks and/or use-after-free. The fix adds the missing dw_dp_unbind() function to allow cleanup.
- CVE-2026-93194Unknown
In the Linux kernel, the drm/rockchip dw_dp driver initializes and registers core resources such as the DisplayPort AUX channel during dw_dp_bind(), but never unregisters them. This leads to memory leaks and/or use-after-free, as shown in a KASAN report. The issue is fixed by using the exported dw_dp_unbind() function in the component's unbind() callback and in its bind() error path.
- CVE-2026-93193Unknown
In the Linux kernel, the drm/rockchip analogix_dp driver has an OF node reference leak in rockchip_dp_drm_encoder_enable(), because of_get_child_by_name() does not call of_node_put() symmetrically. The fix uses __free(device_node) to automatically manage reference release.
- CVE-2026-93188Unknown
In the Linux kernel, the HID roccat driver uses an 8-bit, device-supplied profile index without a range check, even though the profiles array has only 5 elements. A malicious USB device claiming the Roccat Kone id can send a switch-profile event with an out-of-range value, causing an out-of-bounds read that is exposed via the actual_dpi sysfs attribute.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: smack: fix incorrect task context in smack_msg_queue_msgrcv The smack_msg_queue_msgrcv() function incorrectly checks the permissions of the 'current' task instead of the 'target' task. In the msgsnd() syscall path, if a receiver is already waiting, the pipelined_send() optimization is used to push the message directly to the receiver task: ipc/msg.c`pipelined_send(): ` smp_store_release(&msr->r_msg, msg) In this case, the 'sender' (current) task performs the check on behalf of the 'receiver' task (msr->r_tsk, passed as the 'target' parameter): ipc/msg.c`pipelined_send(): ` security_msg_queue_msgrcv(,, target := msr->r_tsk,,) However, smack_msg_queue_msgrcv() ignores the 'target' and checks 'current': smack_msg_queue_msgrcv(…) ` smk_curacc_msq(isp, MAY_READWRITE); // current task 'current' MAY satisfy smack_msg_queue_msgrcv r/w requirement, but 'target' (the receiver task) might NOT; as a result, an unauthorized receiver gets the message, violating MAC policy. Test: 1) create a sysv message queue with label “foo” 2) echo "bar foo r" >/smack/load2 3) msgrcv(,,,0,MSG_NOERROR) in "bar"-labeled task. The task is waiting for the messages ... 4) msgsnd() from a "foo"-labeled task: "bar"-labeled task gets the message. This patch fixes the issue by checking permission on the 'target' task instead of 'current'. (2008-02-04, Casey Schaufler)