GHSA-236X-PHCF-6QMF
Vulnerability from github – Published: 2026-09-25 12:31 – Updated: 2026-09-25 15:31In the Linux kernel, the following vulnerability has been resolved:
landlock: Fix use-after-free of the source's parent directory
current_check_refer_path() reads old_dentry->d_parent without holding a reference nor a lock on it, and then dereferences it in collect_domain_accesses() and in the audit record.
A reference on a child does not pin its parent: __d_move() reassigns dentry->d_parent and drops the reference the child held on its former parent. hook_path_rename() is not affected because the rename path calls lock_rename() before the hook, so the source cannot be reparented under it. hook_path_link() has no such protection: filename_linkat() holds a reference on the source dentry but neither locks nor references its parent, so a concurrent rename(2) can reparent the source while security_path_link() runs, and the former parent can then be removed and freed while the hook walks it.
A process can trigger this after entering a Landlock domain that handles at least one filesystem access right. The process can then race a linkat(2) loop against rename(2) and rmdir(2):
BUG: KASAN: slab-use-after-free in collect_domain_accesses+0x278/0x290 Read of size 4 at addr ffff888160bd53f4 by task llrepro2/549 collect_domain_accesses+0x278/0x290 current_check_refer_path+0x952/0x1120 security_path_link+0x1be/0x320 filename_linkat+0x342/0x6d0 __x64_sys_linkat+0xfa/0x150 Freed by task 562: kmem_cache_free+0x139/0x4c0 i_callback+0x4b/0x80 rcu_core+0x7dc/0x10a0
Take a reference on the dentry selected as the source parent, using dget() for the common-mount-root case and dget_parent() otherwise. Release it after the hierarchy walk and synchronous audit logging.
[mic: Clarify the caller, reachability, and reference handling]
{
"affected": [],
"aliases": [
"CVE-2026-97594"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-25T11:17:10Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nlandlock: Fix use-after-free of the source\u0027s parent directory\n\ncurrent_check_refer_path() reads old_dentry-\u003ed_parent without holding a\nreference nor a lock on it, and then dereferences it in\ncollect_domain_accesses() and in the audit record.\n\nA reference on a child does not pin its parent: __d_move() reassigns\ndentry-\u003ed_parent and drops the reference the child held on its former\nparent. hook_path_rename() is not affected because the rename path\ncalls lock_rename() before the hook, so the source cannot be reparented\nunder it. hook_path_link() has no such protection: filename_linkat()\nholds a reference on the source dentry but neither locks nor references\nits parent, so a concurrent rename(2) can reparent the source while\nsecurity_path_link() runs, and the former parent can then be removed and\nfreed while the hook walks it.\n\nA process can trigger this after entering a Landlock domain that handles\nat least one filesystem access right. The process can then race a\nlinkat(2) loop against rename(2) and rmdir(2):\n\n BUG: KASAN: slab-use-after-free in collect_domain_accesses+0x278/0x290\n Read of size 4 at addr ffff888160bd53f4 by task llrepro2/549\n collect_domain_accesses+0x278/0x290\n current_check_refer_path+0x952/0x1120\n security_path_link+0x1be/0x320\n filename_linkat+0x342/0x6d0\n __x64_sys_linkat+0xfa/0x150\n Freed by task 562:\n kmem_cache_free+0x139/0x4c0\n i_callback+0x4b/0x80\n rcu_core+0x7dc/0x10a0\n\nTake a reference on the dentry selected as the source parent, using\ndget() for the common-mount-root case and dget_parent() otherwise.\nRelease it after the hierarchy walk and synchronous audit logging.\n\n[mic: Clarify the caller, reachability, and reference handling]",
"id": "GHSA-236x-phcf-6qmf",
"modified": "2026-09-25T15:31:43Z",
"published": "2026-09-25T12:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97594"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2c6dc792538260a8087ac5b22c31b3b8e47c85d6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/379efd2ce8b26fd35feb13ccc2f671ff105a5052"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ba29c46ccfe3ebadfb8aa18149186c49f84b14f8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.