CVE-2026-72183

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path

LANDLOCK_SCOPE_SIGNAL must prevent a sandboxed process from signaling

processes outside its Landlock domain. It can be bypassed through the

asynchronous SIGIO delivery path.

A sandboxed process that owns any file or socket can arm it with

fcntl(fd, F_SETOWN, -pgid), fcntl(fd, F_SETSIG, SIGKILL) and O_ASYNC, so

that an I/O event makes the kernel deliver the chosen signal to the

whole process group. As the head of its process group's task list (the

default position right after fork()) that group can also hold the

non-sandboxed process that launched it, e.g. a supervisor or a security

monitor. The sandbox can thus kill or signal the processes

LANDLOCK_SCOPE_SIGNAL is meant to protect from it.

The scope is enforced in hook_file_send_sigiotask() against the Landlock

domain recorded at F_SETOWN time, not the live domain of the sender.

control_current_fowner(

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References