The Linux kernel Smack module had a vulnerability where writing a DOI value to /smack/doi that was previously used would disable networking for non-ambient labels. This was due to Smack keeping decommissioned DOI values and failing to re-add them, which prevented the addition of the default domain map needed for networking. The fix involves clearing decommissioned DOI definitions, serializing concurrent DOI updates with a new lock, allowing /smack/doi to remain unconfigured, and adding new DOI maps before removing old ones to avoid failures.

The vulnerability causes denial of network service for processes labeled with non-ambient Smack labels by disabling the addition of necessary network label mappings. This results in network communication failures such as inability to ping remote hosts. There is no impact on confidentiality or integrity, only availability is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves kernel code changes to clear old DOI definitions and serialize DOI updates. Until a patch is available, avoid writing previously used DOI values to /smack/doi to prevent network disruption.