CVE-2026-97594 (GCVE-0-2026-97594)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:22 – Updated: 2026-09-25 14:41
VLAI
Title
landlock: Fix use-after-free of the source's parent directory
Summary
In the Linux kernel, the following vulnerability has been resolved: landlock: Fix use-after-free of the source's parent directory current_check_refer_path() reads old_dentry->d_parent without holding a reference nor a lock on it, and then dereferences it in collect_domain_accesses() and in the audit record. A reference on a child does not pin its parent: __d_move() reassigns dentry->d_parent and drops the reference the child held on its former parent. hook_path_rename() is not affected because the rename path calls lock_rename() before the hook, so the source cannot be reparented under it. hook_path_link() has no such protection: filename_linkat() holds a reference on the source dentry but neither locks nor references its parent, so a concurrent rename(2) can reparent the source while security_path_link() runs, and the former parent can then be removed and freed while the hook walks it. A process can trigger this after entering a Landlock domain that handles at least one filesystem access right. The process can then race a linkat(2) loop against rename(2) and rmdir(2): BUG: KASAN: slab-use-after-free in collect_domain_accesses+0x278/0x290 Read of size 4 at addr ffff888160bd53f4 by task llrepro2/549 collect_domain_accesses+0x278/0x290 current_check_refer_path+0x952/0x1120 security_path_link+0x1be/0x320 filename_linkat+0x342/0x6d0 __x64_sys_linkat+0xfa/0x150 Freed by task 562: kmem_cache_free+0x139/0x4c0 i_callback+0x4b/0x80 rcu_core+0x7dc/0x10a0 Take a reference on the dentry selected as the source parent, using dget() for the common-mount-root case and dget_parent() otherwise. Release it after the hierarchy walk and synchronous audit logging. [mic: Clarify the caller, reachability, and reference handling]
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b91c3e4ea756b12b7d992529226edce1cfd854d7 , < 379efd2ce8b26fd35feb13ccc2f671ff105a5052 (git)
Affected: b91c3e4ea756b12b7d992529226edce1cfd854d7 , < ba29c46ccfe3ebadfb8aa18149186c49f84b14f8 (git)
Affected: b91c3e4ea756b12b7d992529226edce1cfd854d7 , < 2c6dc792538260a8087ac5b22c31b3b8e47c85d6 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.19
Unaffected: 0 , < 5.19 (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2.7 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/landlock/fs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "379efd2ce8b26fd35feb13ccc2f671ff105a5052",
              "status": "affected",
              "version": "b91c3e4ea756b12b7d992529226edce1cfd854d7",
              "versionType": "git"
            },
            {
              "lessThan": "ba29c46ccfe3ebadfb8aa18149186c49f84b14f8",
              "status": "affected",
              "version": "b91c3e4ea756b12b7d992529226edce1cfd854d7",
              "versionType": "git"
            },
            {
              "lessThan": "2c6dc792538260a8087ac5b22c31b3b8e47c85d6",
              "status": "affected",
              "version": "b91c3e4ea756b12b7d992529226edce1cfd854d7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/landlock/fs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc3",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlandlock: Fix use-after-free of the source\u0027s parent directory\n\ncurrent_check_refer_path() reads old_dentry-\u003ed_parent without holding a\nreference nor a lock on it, and then dereferences it in\ncollect_domain_accesses() and in the audit record.\n\nA reference on a child does not pin its parent: __d_move() reassigns\ndentry-\u003ed_parent and drops the reference the child held on its former\nparent.  hook_path_rename() is not affected because the rename path\ncalls lock_rename() before the hook, so the source cannot be reparented\nunder it.  hook_path_link() has no such protection: filename_linkat()\nholds a reference on the source dentry but neither locks nor references\nits parent, so a concurrent rename(2) can reparent the source while\nsecurity_path_link() runs, and the former parent can then be removed and\nfreed while the hook walks it.\n\nA process can trigger this after entering a Landlock domain that handles\nat least one filesystem access right.  The process can then race a\nlinkat(2) loop against rename(2) and rmdir(2):\n\n  BUG: KASAN: slab-use-after-free in collect_domain_accesses+0x278/0x290\n  Read of size 4 at addr ffff888160bd53f4 by task llrepro2/549\n   collect_domain_accesses+0x278/0x290\n   current_check_refer_path+0x952/0x1120\n   security_path_link+0x1be/0x320\n   filename_linkat+0x342/0x6d0\n   __x64_sys_linkat+0xfa/0x150\n  Freed by task 562:\n   kmem_cache_free+0x139/0x4c0\n   i_callback+0x4b/0x80\n   rcu_core+0x7dc/0x10a0\n\nTake a reference on the dentry selected as the source parent, using\ndget() for the common-mount-root case and dget_parent() otherwise.\nRelease it after the hierarchy walk and synchronous audit logging.\n\n[mic: Clarify the caller, reachability, and reference handling]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The trigger is a local linkat(2) syscall: filename_linkat() -\u003e security_path_link() -\u003e hook_path_link() -\u003e current_check_refer_path(), raced against local rename(2)/rmdir(2). No remote protocol supplies any of the input.\nAC:L - The attacker runs every side of the race: a linkat() loop on their own file, plus rename() to reparent the source and rmdir() to free the old parent, all in directories they create (e.g. /tmp). No condition outside the attacker\u0027s control is needed; the window can be retried at will.\nPR:L - An ordinary unprivileged user can enter a Landlock domain that handles any FS right (landlock_create_ruleset + landlock_restrict_self after PR_SET_NO_NEW_PRIVS, no capability needed); that makes landlock_get_applicable_subject() non-NULL and reaches the unpinned d_parent read.\nUI:N - The attacker\u0027s own syscalls on files and directories they own trigger the bug; no other user or administrator has to do anything.\nS:U - The corruption happens in kernel memory under the same kernel authority; exploiting it is standard local privilege escalation, not a crossing into a separate authority such as a hypervisor.\nC:H - collect_domain_accesses() dereferences the freed old_parent dentry and follows its d_parent/d_inode pointers into the Landlock inode blob via find_rule(). If the attacker reallocates the freed slab, they control pointers that the kernel then follows and reads.\nI:H - collect_domain_accesses() calls dget() and later dput() on the freed dentry. That writes the lockref inside the freed or reallocated object and can run dentry teardown on it, a write primitive that can lead to a double free or control-flow hijack.\nA:H - The KASAN report in the commit shows a slab use-after-free in collect_domain_accesses(). On production kernels the refcount changes on freed memory or the stale pointer walk can oops or panic the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:27.794Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/379efd2ce8b26fd35feb13ccc2f671ff105a5052"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba29c46ccfe3ebadfb8aa18149186c49f84b14f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c6dc792538260a8087ac5b22c31b3b8e47c85d6"
        }
      ],
      "title": "landlock: Fix use-after-free of the source\u0027s parent directory",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97594",
    "datePublished": "2026-09-25T10:22:10.548Z",
    "dateReserved": "2026-09-24T16:01:01.157Z",
    "dateUpdated": "2026-09-25T14:41:27.794Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-97594",
      "date": "2026-09-28",
      "epss": "0.00157",
      "percentile": "0.04141"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-28T00:02:01.000Z",
      "cve": "CVE-2026-97594",
      "id": "msrc_CVE-2026-97594",
      "initial_release_date": "2026-09-28T00:02:01.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "landlock: Fix use-after-free of the source\u0027s parent directory",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-97594.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "security/landlock/fs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "379efd2ce8b26fd35feb13ccc2f671ff105a5052",
                    "status": "affected",
                    "version": "b91c3e4ea756b12b7d992529226edce1cfd854d7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ba29c46ccfe3ebadfb8aa18149186c49f84b14f8",
                    "status": "affected",
                    "version": "b91c3e4ea756b12b7d992529226edce1cfd854d7",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2c6dc792538260a8087ac5b22c31b3b8e47c85d6",
                    "status": "affected",
                    "version": "b91c3e4ea756b12b7d992529226edce1cfd854d7",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "security/landlock/fs.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.19"
                  },
                  {
                    "lessThan": "5.19",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlandlock: Fix use-after-free of the source\u0027s parent directory\n\ncurrent_check_refer_path() reads old_dentry-\u003ed_parent without holding a\nreference nor a lock on it, and then dereferences it in\ncollect_domain_accesses() and in the audit record.\n\nA reference on a child does not pin its parent: __d_move() reassigns\ndentry-\u003ed_parent and drops the reference the child held on its former\nparent.  hook_path_rename() is not affected because the rename path\ncalls lock_rename() before the hook, so the source cannot be reparented\nunder it.  hook_path_link() has no such protection: filename_linkat()\nholds a reference on the source dentry but neither locks nor references\nits parent, so a concurrent rename(2) can reparent the source while\nsecurity_path_link() runs, and the former parent can then be removed and\nfreed while the hook walks it.\n\nA process can trigger this after entering a Landlock domain that handles\nat least one filesystem access right.  The process can then race a\nlinkat(2) loop against rename(2) and rmdir(2):\n\n  BUG: KASAN: slab-use-after-free in collect_domain_accesses+0x278/0x290\n  Read of size 4 at addr ffff888160bd53f4 by task llrepro2/549\n   collect_domain_accesses+0x278/0x290\n   current_check_refer_path+0x952/0x1120\n   security_path_link+0x1be/0x320\n   filename_linkat+0x342/0x6d0\n   __x64_sys_linkat+0xfa/0x150\n  Freed by task 562:\n   kmem_cache_free+0x139/0x4c0\n   i_callback+0x4b/0x80\n   rcu_core+0x7dc/0x10a0\n\nTake a reference on the dentry selected as the source parent, using\ndget() for the common-mount-root case and dget_parent() otherwise.\nRelease it after the hierarchy walk and synchronous audit logging.\n\n[mic: Clarify the caller, reachability, and reference handling]"
          }
        ],
        "id": "CVE-2026-97594",
        "lastModified": "2026-09-25T15:18:00.670",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-25T11:17:10.653",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2c6dc792538260a8087ac5b22c31b3b8e47c85d6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/379efd2ce8b26fd35feb13ccc2f671ff105a5052"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ba29c46ccfe3ebadfb8aa18149186c49f84b14f8"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.