The Linux kernel’s Smack security module incorrectly accepts a DOI value that has been used in the past. When such a previously used value is written to the /smack/doi file, Smack fails to re‑add the corresponding DOI mapping and the default domain map is removed from the kernel’s configuration. With the default map missing, the kernel refuses to create new network labels for non‑ambient traffic and any network operation that relies on these labels is rejected. This manifests as a loss of networking functionality for affected processes, effectively denying network service.

All Linux kernel‑based systems that employ the Smack label mechanism are impacted. The flaw is tied to the kernel’s handling of /smack/doi rather than a distribution or specific kernel version, so any system that configures or updates DOI values and has not applied the documented kernel patch is susceptible.

Exploitation requires the ability to write to /smack/doi, which typically demands elevated privileges, but local users with sufficient rights may trigger it. The EPSS score is unavailable and the vulnerability is not in the CISA KEV catalog, but the potential to disable networking on a host means the impact is significant until the kernel is patched.