Unrated severityNVD Advisory· Published Dec 24, 2025· Updated Apr 15, 2026
CVE-2025-68733
CVE-2025-68733
Description
In the Linux kernel, the following vulnerability has been resolved:
smack: fix bug: unprivileged task can create labels
If an unprivileged task is allowed to relabel itself (/smack/relabel-self is not empty), it can freely create new labels by writing their names into own /proc/PID/attr/smack/current
This occurs because do_setattr() imports the provided label in advance, before checking "relabel-self" list.
This change ensures that the "relabel-self" list is checked before importing the label.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
38- osv-coords36 versionspkg:linux/kernelpkg:rpm/opensuse/kernel-source&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/kernel-source-longterm&distro=openSUSE%20Tumbleweedpkg:rpm/suse/kernel-64kb&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7pkg:rpm/suse/kernel-azure&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Public%20Cloud%2015%20SP7pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Micro%206.0pkg:rpm/suse/kernel-default-base&distro=SUSE%20Linux%20Micro%206.1pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015%20SP7pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP7pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Legacy%2015%20SP7pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP7pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Micro%206.0pkg:rpm/suse/kernel-default&distro=SUSE%20Linux%20Micro%206.1pkg:rpm/suse/kernel-docs&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP7pkg:rpm/suse/kernel-kvmsmall&distro=SUSE%20Linux%20Micro%206.0pkg:rpm/suse/kernel-kvmsmall&distro=SUSE%20Linux%20Micro%206.1pkg:rpm/suse/kernel-livepatch-SLE15-SP7-RT_Update_9&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP7pkg:rpm/suse/kernel-livepatch-SLE15-SP7_Update_9&distro=SUSE%20Linux%20Enterprise%20Live%20Patching%2015%20SP7pkg:rpm/suse/kernel-obs-build&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP7pkg:rpm/suse/kernel-rt&distro=SUSE%20Linux%20Micro%206.0pkg:rpm/suse/kernel-rt&distro=SUSE%20Linux%20Micro%206.1pkg:rpm/suse/kernel-rt&distro=SUSE%20Real%20Time%20Module%2015%20SP7pkg:rpm/suse/kernel-source-azure&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Public%20Cloud%2015%20SP7pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP7pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Micro%206.0pkg:rpm/suse/kernel-source&distro=SUSE%20Linux%20Micro%206.1pkg:rpm/suse/kernel-source-rt&distro=SUSE%20Linux%20Micro%206.0pkg:rpm/suse/kernel-source-rt&distro=SUSE%20Linux%20Micro%206.1pkg:rpm/suse/kernel-source-rt&distro=SUSE%20Real%20Time%20Module%2015%20SP7pkg:rpm/suse/kernel-syms-azure&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Public%20Cloud%2015%20SP7pkg:rpm/suse/kernel-syms&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP7pkg:rpm/suse/kernel-syms-rt&distro=SUSE%20Real%20Time%20Module%2015%20SP7pkg:rpm/suse/kernel-zfcpdump&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7
>= 4.4.0, < 5.10.248+ 35 more
- (no CPE)range: >= 4.4.0, < 5.10.248
- (no CPE)range: < 6.18.5-1.1
- (no CPE)range: < 6.18.16-1.1
- (no CPE)range: < 6.4.0-150700.53.31.1
- (no CPE)range: < 6.4.0-150700.20.27.1
- (no CPE)range: < 6.4.0-150700.53.31.1.150700.17.21.1
- (no CPE)range: < 6.4.0-39.1.21.16
- (no CPE)range: < 6.4.0-39.1.21.16
- (no CPE)range: < 6.4.0-150700.53.31.1
- (no CPE)range: < 6.4.0-150700.53.31.1
- (no CPE)range: < 6.4.0-150700.53.31.1
- (no CPE)range: < 6.4.0-150700.53.31.1
- (no CPE)range: < 6.4.0-150700.53.31.1
- (no CPE)range: < 6.4.0-39.1
- (no CPE)range: < 6.4.0-39.1
- (no CPE)range: < 6.4.0-150700.53.31.1
- (no CPE)range: < 6.4.0-39.1
- (no CPE)range: < 6.4.0-39.1
- (no CPE)range: < 1-150700.1.3.2
- (no CPE)range: < 1-150700.15.3.1
- (no CPE)range: < 6.4.0-150700.53.31.1
- (no CPE)range: < 6.4.0-40.1
- (no CPE)range: < 6.4.0-40.1
- (no CPE)range: < 6.4.0-150700.7.31.2
- (no CPE)range: < 6.4.0-150700.20.27.1
- (no CPE)range: < 6.4.0-150700.53.31.1
- (no CPE)range: < 6.4.0-150700.53.31.1
- (no CPE)range: < 6.4.0-39.1
- (no CPE)range: < 6.4.0-39.1
- (no CPE)range: < 6.4.0-40.1
- (no CPE)range: < 6.4.0-40.1
- (no CPE)range: < 6.4.0-150700.7.31.1
- (no CPE)range: < 6.4.0-150700.20.27.1
- (no CPE)range: < 6.4.0-150700.53.31.1
- (no CPE)range: < 6.4.0-150700.7.31.1
- (no CPE)range: < 6.4.0-150700.53.31.1
Patches
Vulnerability mechanics
References
8- git.kernel.org/stable/c/4a7a7621619a366712fb9cefcb6e69f956c247cenvd
- git.kernel.org/stable/c/60e8d49989410a7ade60f5dadfcd979c117d05c0nvd
- git.kernel.org/stable/c/64aa81250171b6bb6803e97ea7a5d73bfa061f6envd
- git.kernel.org/stable/c/6b1e45e13546c9ea0b1d99097993ac0aafae90b1nvd
- git.kernel.org/stable/c/ac9fce2efabad37c338aac86fbe100f77a080e59nvd
- git.kernel.org/stable/c/c147e13ea7fe9f118f8c9ba5e96cbd644b00d6b3nvd
- git.kernel.org/stable/c/c80173233014a360c13fa5cc79d36bfe6e53a8ednvd
- git.kernel.org/stable/c/f8fd5491100f920847a3338d5fba22db19c72773nvd
News mentions
0No linked articles in our index yet.