CVE-2025-68733: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68733 is a security flaw in the Linux kernel's Smack (Simplified Mandatory Access Control Kernel) subsystem that allows unprivileged tasks to create arbitrary security labels. When /smack/relabel-self is configured to permit a task to relabel itself, the do_setattr() function incorrectly imports a user-supplied label before validating it against the "relabel-self" list, enabling creation of new, unauthorized labels via writes to /proc/PID/attr/smack/current. The vulnerability was disclosed on December 24, 2025, and affects Linux kernel versions from commit 38416e53936ecf896948fdeffc36b76979117952 up to the respective fix commits across stable branches. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is an improper authorization check (CWE-863) in the Smack LSM's do_setattr() function: the kernel imports the caller-supplied label into its internal label table before verifying whether the label is present in the task's "relabel-self" allowlist. Because label import is a side effect that persists even if the subsequent authorization check fails, an unprivileged task with any relabeling permission can inject arbitrary new label names into the kernel's Smack label namespace. Exploitation requires local access and low privileges, with no user interaction needed; the precondition is that /smack/relabel-self must be non-empty (i.e., the system must be configured to allow at least one self-relabeling operation). Patches are available in the upstream stable tree at multiple commit points (Red Hat CVE, ENISA EUVD).

Successful exploitation allows an unprivileged local user to create arbitrary Smack security labels, potentially undermining the integrity of the mandatory access control policy enforced by Smack. This could enable unauthorized modification of security contexts, potentially facilitating privilege escalation or unauthorized access to resources that rely on Smack label-based access controls. Confidentiality impact is assessed as none, while integrity impact is rated high; availability is not directly affected (Red Hat CVE, Feedly).

1. Identify target system: Confirm the target Linux system uses Smack as its LSM and that /smack/relabel-self is non-empty, indicating at least one self-relabeling permission is configured.
2. Obtain low-privileged local access: Gain a shell or code execution as any unprivileged user on the system (e.g., via SSH, a web shell, or another vulnerability).
3. Write arbitrary label to /proc/PID/attr/smack/current: As the unprivileged user, write a new, previously non-existent label name to /proc/self/attr/smack/current. Due to the bug, do_setattr() imports the label into the kernel's Smack label table before checking the relabel-self list.
4. Observe label creation: Even if the relabeling operation is ultimately denied, the new label name is now registered in the kernel's Smack label namespace, bypassing the intended restriction on label creation.
5. Leverage new labels: Use the newly created labels to potentially manipulate Smack policy decisions or escalate access to resources whose access controls depend on label enumeration or matching (Red Hat CVE, Feedly).

• Logs: Audit log entries (auditd) showing repeated writes to /proc/<PID>/attr/smack/current by unprivileged users, especially with label names not present in the system's Smack policy.
• File System: Unexpected or unknown label names appearing in /smack/load or /smack/load2 that do not correspond to any configured policy rules.
• Process: Processes running under unusual or newly created Smack labels that are not part of the baseline policy configuration.

Apply the upstream kernel patches available for the affected stable branches: commits ac9fce2efabad37c338aac86fbe100f77a080e59, 64aa81250171b6bb6803e97ea7a5d73bfa061f6e, 60e8d49989410a7ade60f5dadfcd979c117d05c0, and c147e13ea7fe9f118f8c9ba5e96cbd644b00d6b3, corresponding to fixed versions 6.12.63, 6.17.13, 6.18.2, and 6.19-rc1 respectively (ENISA EUVD). Distribution-specific updates are available from Debian (linux 6.1.162-1, linux 5.10.249-1), Ubuntu (USN-8179-1 through USN-8265-1, USN-8203-1, USN-8258-1, USN-8260-1), and SUSE (SUSE-2026-0447-1) (Ubuntu USN-8179-1, Debian Tracker). As a workaround, restrict or empty /smack/relabel-self to prevent any task from self-relabeling, which eliminates the precondition for exploitation. Monitor and audit all writes to /proc/*/attr/smack/current as an additional defensive measure.