High [CVE-2026-64111] hold cred_guard_mutex for lsm_set_self_attr

In the Linux kernel, the following vulnerability has been resolved: lsm: hold cred_guard_mutex for lsm_set_self_attr() Just as proc_pid_attr_write() already does before calling the LSM hook. This only matters for SELinux and AppArmor which check whether the process is being ptraced and if so, whether to allow the transition.

A flaw was found in the Linux kernel's Security Module (LSM). A local attacker could exploit this vulnerability by leveraging an improper handling of a credential guard mutex in the `lsm_set_self_attr()` function.

This oversight may allow the attacker to bypass security restrictions enforced by modules such as SELinux and AppArmor when a process is being debugged, potentially leading to unauthorized access or privilege escalation.

This vulnerability is evaluated with a Moderate impact because exploitation requires local access, existing process tracing capabilities, and winning a precise race condition to evade security enforcement.

Earlier enterprise distributions, including Red Hat Enterprise Linux 8 and 9, are unaffected because they do not include the newer LSM system call interfaces. On affected platforms, an authenticated local attacker might bypass policy transition controls enforced by mandatory access control frameworks such as SELinux.

Red Hat severity: Moderate — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-412.