CVE-2026-72183 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path
LANDLOCK_SCOPE_SIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery path.
A sandboxed process that owns any file or socket can arm it with fcntl(fd, F_SETOWN, -pgid), fcntl(fd, F_SETSIG, SIGKILL) and O_ASYNC, so that an I/O event makes the kernel deliver the chosen signal to the whole process group. As the head of its process group's task list (the default position right after fork()) that group can also hold the non-sandboxed process that launched it, e.g. a supervisor or a security monitor. The sandbox can thus kill or signal the processes LANDLOCK_SCOPE_SIGNAL is meant to protect from it.
The scope is enforced in hook_file_send_sigiotask() against the Landlock domain recorded at F_SETOWN time, not the live domain of the sender. control_current_fowner() decides whether to record that domain and skips recording it when the fowner target is in the caller's thread group, which is safe only for a single-task target (PIDTYPE_PID, PIDTYPE_TGID). For a process group (PIDTYPE_PGID) pid_task() returns only one member; recording is skipped whenever that member shares the caller's thread group, and hook_file_send_sigiotask() then lets the signal fan out to the whole group unchecked.
Record the domain for every non single-process target so the scope is enforced against each group member at delivery time.
That recording is necessary but not sufficient on its own: the kernel signals a process group through its members' thread-group leaders, and the leader of the registrant's own process can carry a different Landlock domain than the sibling thread that armed the owner. domain_is_scoped() would then deny that leader, even though commit 18eb75f3af40 ("landlock: Always allow signals between threads of the same process") requires same-process delivery to be allowed. hook_task_kill() avoids this by evaluating same_thread_group() live, per recipient; the SIGIO path instead delegates the whole decision to a single registration-time check, which a process-group fan-out cannot honor.
So also record the registrant's thread group next to its domain and exempt it at delivery: hook_file_send_sigiotask() allows the signal whenever the recipient belongs to the registrant's own process, restoring the same-process guarantee while keeping out-of-domain group members blocked. The direct kill() path (hook_task_kill) already evaluates the live domain and is unaffected.
[mic: Check pid_type earlier and improve comment, fix commit message,
fix comment formatting]
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability resides within the Linux kernel's Landlock security module, specifically addressing a critical bypass in the LANDLOCK_SCOPE_SIGNAL enforcement mechanism. The flaw enables sandboxed processes to circumvent signal restrictions that should prevent them from targeting processes outside their designated Landlock domain. The issue manifests through the asynchronous SIGIO delivery path where a sandboxed process can manipulate file descriptors to generate signals that propagate beyond intended boundaries. This represents a fundamental failure in the kernel's security model, as it undermines the core principle of process isolation that Landlock is designed to enforce.
The technical implementation of this vulnerability exploits the interaction between file descriptor ownership mechanisms and signal delivery pathways within the Linux kernel. When a sandboxed process sets up asynchronous I/O using fcntl(fd, F_SETOWN, -pgid), fcntl(fd, F_SETSIG, SIGKILL), and O_ASYNC flags, it can configure file operations to trigger signals that fan out to entire process groups. The vulnerability stems from how the kernel records Landlock domain information at registration time versus delivery time. Specifically, control_current_fowner() function only records domain information when the fowner target is a single-process target rather than a process group, leading to incomplete enforcement when dealing with PIDTYPE_PGID targets.
The operational impact of this vulnerability extends beyond simple privilege escalation, potentially enabling malicious sandboxed processes to compromise security monitoring tools or supervisor processes that operate outside their intended domains. This bypass allows attackers to leverage legitimate I/O operations as attack vectors for signal-based attacks against non-sandboxed processes, effectively neutralizing the protection mechanisms designed to contain sandboxed applications. The vulnerability aligns with CWE-284 Access Control Issues and represents a direct violation of the principle of least privilege that Landlock aims to enforce.
The fix implemented addresses this by ensuring domain information is recorded for all non-single-process targets, not just single-process ones. This change requires modifications to hook_file_send_sigiotask() function to evaluate the registrant's thread group alongside its domain at delivery time rather than relying solely on registration-time checks. The solution also incorporates logic to exempt same-thread-group recipients while maintaining restrictions on out-of-domain process group members, effectively restoring the intended security boundaries. This approach aligns with ATT&CK technique T1059 Command and Scripting Interpreter by enabling unauthorized signal delivery through legitimate kernel interfaces. The fix specifically addresses commit 18eb75f3af40 which previously established that same-process signal delivery should be allowed, ensuring consistency in the kernel's security model while maintaining proper boundary enforcement for cross-domain communications.