Skip to content
Heist/ feed
High

landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path LANDLOCK_SCOPE_SIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery path. A sandboxed process that owns any file or socket can arm it with fcntl(fd, F_SETOWN, -pgid), fcntl(fd, F_SETSIG, SIGKILL) and O_ASYNC, so that an I/O event makes the kernel deliver the chosen signal to the whole process group. As the head of its process group's task list (the default position right after fork()) that group can also hold the non-sandboxed process that launched it, e.g. a supervisor or a security monitor. The sandbox can thus kill or signal the processes LANDLOCK_SCOPE_SIGNAL is meant to protect from it. The scope is enforced in hook_file_send_sigiotask() against the Landlock domain recorded at F_SETOWN time, not the live domain of the sender. control_current_fowner() decides whether to record that domain and skips recording it when the fowner target is in the caller's thread group, which is safe only for a single-task target (PIDTYPE_PID, PIDTYPE_TGID). For a process group (PIDTYPE_PGID) pid_task() returns only one member; recording is skipped whenever that member shares the caller's thread group, and hook_file_send_sigiotask() then lets the signal fan out to the whole group unchecked. Record the domain for every non single-process target so the scope is enforced

Announced Source revision 1
Original source ↗

CVE-2026-72183

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-72183

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "332facfa80751b80006c2f95b13c6d208ab0aee1",
        "lessThan": "7a92e9fd1d496a610b40e0c4253fd54e7496f5ab",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "18eb75f3af40be1f0fc2025d4ff821711222a2fd",
        "lessThan": "1f18aac2637220b5847d073447498e81ddca10b2",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "18eb75f3af40be1f0fc2025d4ff821711222a2fd",
        "lessThan": "04916f7dc6d37cd478b06c86398c34a6963ac8c9",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "18eb75f3af40be1f0fc2025d4ff821711222a2fd",
        "lessThan": "4b80320ca7ed03d6e683f95b6066565dc97b9f92",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6861348d863c0eaa4af67492d640a9644a829c59",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "0906a9685d7057aea982e970da3e1cf3e5aca68b",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6.12.24",
        "lessThan": "6.12.101",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "6.13.12",
        "lessThan": "6.14",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "6.14.3",
        "lessThan": "6.15",
        "versionType": "semver"
      }
    ],
    "programFiles": [
      "security/landlock/fs.c",
      "security/landlock/fs.h",
      "security/landlock/task.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "6.15"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "6.15",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.12.101",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.40",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.1.5",
        "versionType": "semver",
        "lessThanOrEqual": "7.1.*"
      },
      {
        "status": "unaffected",
        "version": "7.2",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "security/landlock/fs.c",
      "security/landlock/fs.h",
      "security/landlock/task.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-72183

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#32967 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement