CVE-2025-71304

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Smack access control module where writing a previously used value to the '/smack/doi' endpoint disables networking for non-ambient labels. This occurs because the system retains decommissioned Domain of Interpretation (DOI) definitions and fails to re-add them, which prevents the addition of the default domain map. Technical resolution involves clearing decommissioned DOI definitions, implementing a new lock to serialize concurrent DOI updates, and ensuring new DOIs are added before removing old default maps to maintain connectivity if the addition fails. Additionally, the system now allows '/smack/doi' to remain unconfigured, using CIPSO V4 DOI UNKNOWN(0) to indicate this state, and utilizes the netlbl cfg cipsov4 map add() function for map additions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.