CVE-2026-97594
Received Received - Intake

Use-After-Free in Linux Kernel Landlock

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: landlock: Fix use-after-free of the source's parent directory current_check_refer_path() reads old_dentry->d_parent without holding a reference nor a lock on it, and then dereferences it in collect_domain_accesses() and in the audit record. A reference on a child does not pin its parent: __d_move() reassigns dentry->d_parent and drops the reference the child held on its former parent. hook_path_rename() is not affected because the rename path calls lock_rename() before the hook, so the source cannot be reparented under it. hook_path_link() has no such protection: filename_linkat() holds a reference on the source dentry but neither locks nor references its parent, so a concurrent rename(2) can reparent the source while security_path_link() runs, and the former parent can then be removed and freed while the hook walks it. A process can trigger this after entering a Landlock domain that handles at least one filesystem access right. The process can then race a linkat(2) loop against rename(2) and rmdir(2): BUG: KASAN: slab-use-after-free in collect_domain_accesses+0x278/0x290 Read of size 4 at addr ffff888160bd53f4 by task llrepro2/549 collect_domain_accesses+0x278/0x290 current_check_refer_path+0x952/0x1120 security_path_link+0x1be/0x320 filename_linkat+0x342/0x6d0 __x64_sys_linkat+0xfa/0x150 Freed by task 562: kmem_cache_free+0x139/0x4c0 i_callback+0x4b/0x80 rcu_core+0x7dc/0x10a0 Take a reference on the dentry selected as the source parent, using dget() for the common-mount-root case and dget_parent() otherwise. Release it after the hierarchy walk and synchronous audit logging. [mic: Clarify the caller, reachability, and reference handling]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97594
EUVD
EUVD-2026-86902

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel landlock *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's Landlock security module. It occurs when the kernel tries to access a parent directory of a file without properly holding a reference or lock on it. A race condition can be triggered by a process in a Landlock domain performing linkat(2) operations while another process renames or removes the parent directory, causing a use-after-free error.

Detection Guidance

This vulnerability is specific to the Linux kernel's Landlock module and involves a use-after-free condition in filesystem access handling. Detection requires kernel-level monitoring for slab-use-after-free errors, particularly during linkat(2), rename(2), or rmdir(2) operations. Check kernel logs for KASAN reports or slab corruption messages. Commands like dmesg | grep -i kasan or journalctl -k | grep -i slab-use-after-free may help identify such issues.

Impact Analysis

An attacker with local access could exploit this to cause a kernel crash (denial of service) or potentially execute arbitrary code with kernel privileges. Systems using Landlock for sandboxing are at higher risk. The vulnerability requires a process to already be in a Landlock domain handling filesystem access rights.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this Landlock use-after-free issue. If immediate patching is not possible, consider disabling Landlock functionality via kernel boot parameters (e.g., landlock=0) or restricting untrusted processes from using Landlock. Monitor kernel logs for signs of exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97594. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart