CVE-2026-97594

Received Received - Intake

Use-After-Free in Linux Kernel Landlock

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix use-after-free of the source's parent directory current_check_refer_path() reads old_dentry->d_parent without holding a reference nor a lock on it, and then dereferences it in collect_domain_accesses() and in the audit record. A reference on a child does not pin its parent: __d_move() reassigns dentry->d_parent and drops the reference the child held on its former parent. hook_path_rename() is not affected because the rename path calls lock_rename() before the hook, so the source cannot be reparented under it. hook_path_link() has no such protection: filename_linkat() holds a reference on the source dentry but neither locks nor references its parent, so a concurrent rename(2) can reparent the source while security_path_link() runs, and the former parent can then be removed and freed while the hook walks it. A process can trigger this after entering a Landlock domain that handles at least one filesystem access right. The process can then race a linkat(2) loop against rename(2) and rmdir(2): BUG: KASAN: slab-use-after-free in collect_domain_accesses+0x278/0x290 Read of size 4 at addr ffff888160bd53f4 by task llrepro2/549 collect_domain_accesses+0x278/0x290 current_check_refer_path+0x952/0x1120 security_path_link+0x1be/0x320 filename_linkat+0x342/0x6d0 __x64_sys_linkat+0xfa/0x150 Freed by task 562: kmem_cache_free+0x139/0x4c0 i_callback+0x4b/0x80 rcu_core+0x7dc/0x10a0 Take a reference on the dentry selected as the source parent, using dget() for the common-mount-root case and dget_parent() otherwise. Release it after the hierarchy walk and synchronous audit logging. [mic: Clarify the caller, reachability, and reference handling]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97594

EUVD

EUVD-2026-86902

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	landlock	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's Landlock security module. It occurs when the kernel tries to access a parent directory of a file without properly holding a reference or lock on it. A race condition can be triggered by a process in a Landlock domain performing linkat(2) operations while another process renames or removes the parent directory, causing a use-after-free error.

Detection Guidance

This vulnerability is specific to the Linux kernel's Landlock module and involves a use-after-free condition in filesystem access handling. Detection requires kernel-level monitoring for slab-use-after-free errors, particularly during linkat(2), rename(2), or rmdir(2) operations. Check kernel logs for KASAN reports or slab corruption messages. Commands like dmesg | grep -i kasan or journalctl -k | grep -i slab-use-after-free may help identify such issues.

Impact Analysis

An attacker with local access could exploit this to cause a kernel crash (denial of service) or potentially execute arbitrary code with kernel privileges. Systems using Landlock for sandboxing are at higher risk. The vulnerability requires a process to already be in a Landlock domain handling filesystem access rights.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's Landlock security module, which could allow local attackers to escalate privileges or cause denial of service. It does not directly impact data protection or privacy compliance standards like GDPR or HIPAA, as those focus on data handling and security controls rather than kernel-level memory corruption issues.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this Landlock use-after-free issue. If immediate patching is not possible, consider disabling Landlock functionality via kernel boot parameters (e.g., landlock=0) or restricting untrusted processes from using Landlock. Monitor kernel logs for signs of exploitation attempts.

Hi! I’m here to help you understand CVE-2026-97594. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70