CVE-2026-64111

A flaw was found in the Linux kernel's Security Module (LSM). A local attacker could exploit this vulnerability by leveraging an improper handling of a credential guard mutex in the lsm_set_self_attr() function. This oversight may allow the attacker to bypass security restrictions enforced by modules such as SELinux and AppArmor when a process is being debugged, potentially leading to unauthorized access or privilege escalation.

This vulnerability is evaluated with a Moderate impact because exploitation requires local access, existing process tracing capabilities, and winning a precise race condition to evade security enforcement. Earlier enterprise distributions, including Red Hat Enterprise Linux 8 and 9, are unaffected because they do not include the newer LSM system call interfaces. On affected platforms, an authenticated local attacker might bypass policy transition controls enforced by mandatory access control frameworks such as SELinux.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.