« Volver al listado

CVE-2025-68733

Estado: AplazadaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

smack: fix bug: unprivileged task can create labels

If an unprivileged task is allowed to relabel itself (/smack/relabel-self is not empty), it can freely create new labels by writing their names into own /proc/PID/attr/smack/current

This occurs because do_setattr() imports the provided label in advance, before checking "relabel-self" list.

This change ensures that the "relabel-self" list is checked before importing the label.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-68733",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "38416e53936ecf896948fdeffc36b76979117952",
              "lessThan": "c80173233014a360c13fa5cc79d36bfe6e53a8ed",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "38416e53936ecf896948fdeffc36b76979117952",
              "lessThan": "6b1e45e13546c9ea0b1d99097993ac0aafae90b1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "38416e53936ecf896948fdeffc36b76979117952",
              "lessThan": "4a7a7621619a366712fb9cefcb6e69f956c247ce",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "38416e53936ecf896948fdeffc36b76979117952",
              "lessThan": "f8fd5491100f920847a3338d5fba22db19c72773",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "38416e53936ecf896948fdeffc36b76979117952",
              "lessThan": "ac9fce2efabad37c338aac86fbe100f77a080e59",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "38416e53936ecf896948fdeffc36b76979117952",
              "lessThan": "64aa81250171b6bb6803e97ea7a5d73bfa061f6e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "38416e53936ecf896948fdeffc36b76979117952",
              "lessThan": "60e8d49989410a7ade60f5dadfcd979c117d05c0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "38416e53936ecf896948fdeffc36b76979117952",
              "lessThan": "c147e13ea7fe9f118f8c9ba5e96cbd644b00d6b3",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "security/smack/smack_lsm.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.4",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.63",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.17.13",
              "versionType": "semver",
              "lessThanOrEqual": "6.17.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.2",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "security/smack/smack_lsm.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-12-24T11:16:02.600",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/4a7a7621619a366712fb9cefcb6e69f956c247ce",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/60e8d49989410a7ade60f5dadfcd979c117d05c0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/64aa81250171b6bb6803e97ea7a5d73bfa061f6e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6b1e45e13546c9ea0b1d99097993ac0aafae90b1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ac9fce2efabad37c338aac86fbe100f77a080e59",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c147e13ea7fe9f118f8c9ba5e96cbd644b00d6b3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c80173233014a360c13fa5cc79d36bfe6e53a8ed",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f8fd5491100f920847a3338d5fba22db19c72773",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmack: fix bug: unprivileged task can create labels\n\nIf an unprivileged task is allowed to relabel itself\n(/smack/relabel-self is not empty),\nit can freely create new labels by writing their\nnames into own /proc/PID/attr/smack/current\n\nThis occurs because do_setattr() imports\nthe provided label in advance,\nbefore checking \"relabel-self\" list.\n\nThis change ensures that the \"relabel-self\" list\nis checked before importing the label."
    }
  ],
  "lastModified": "2026-06-17T09:59:29.853",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}