CVE-2025-46805

A flaw was found in Screen. A possible denial of service caused by race conditions when sending signals exists. The CheckPid() function drops privileges to the real user ID and tests whether the kernel can send a signal to the target PID using these credentials. The signal is sent later via Kill(), potentially using full root privileges. By this time, the previously checked PID could have been replaced by a different, privileged process. It might also be possible to trick the privileged Screen daemon process into sending signals to itself since a process is always allowed to send signals to itself.

This is a moderate vulnerability because it involves a TOCTOU race condition with limited impact: only SIGCONT and SIGHUP signals can be sent, which do not allow arbitrary code execution or privilege escalation. Exploitation requires precise PID reuse timing, reducing reliability. Although it breaks privilege separation by using root rights after a lower-privileged check, the constrained effect—primarily minor integrity issues or local DoS—limits its severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.