{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-97594", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-97594" ], "published": "2026-09-25T10:24:31Z", "summary": "landlock: Fix use-after-free of the source's parent directory", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nlandlock: Fix use-after-free of the source's parent directory\n\ncurrent_check_refer_path() reads old_dentry->d_parent without holding a\nreference nor a lock on it, and then dereferences it in\ncollect_domain_accesses() and in the audit record.\n\nA reference on a child does not pin its parent: __d_move() reassigns\ndentry->d_parent and drops the reference the child held on its former\nparent. hook_path_rename() is not affected because the rename path\ncalls lock_rename() before the hook, so the source cannot be reparented\nunder it. hook_path_link() has no such protection: filename_linkat()\nholds a reference on the source dentry but neither locks nor references\nits parent, so a concurrent rename(2) can reparent the source while\nsecurity_path_link() runs, and the former parent can then be removed and\nfreed while the hook walks it.\n\nA process can trigger this after entering a Landlock domain that handles\nat least one filesystem access right. The process can then race a\nlinkat(2) loop against rename(2) and rmdir(2):\n\n BUG: KASAN: slab-use-after-free in collect_domain_accesses+0x278/0x290\n Read of size 4 at addr ffff888160bd53f4 by task llrepro2/549\n collect_domain_accesses+0x278/0x290\n current_check_refer_path+0x952/0x1120\n security_path_link+0x1be/0x320\n filename_linkat+0x342/0x6d0\n __x64_sys_linkat+0xfa/0x150\n Freed by task 562:\n kmem_cache_free+0x139/0x4c0\n i_callback+0x4b/0x80\n rcu_core+0x7dc/0x10a0\n\nTake a reference on the dentry selected as the source parent, using\ndget() for the common-mount-root case and dget_parent() otherwise.\nRelease it after the hierarchy walk and synchronous audit logging.\n\n[mic: Clarify the caller, reachability, and reference handling]", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.1.47-1+rpt4" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.1.0-rpi3-rpi-2712", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v6", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v8", "binary_version": "1:6.1.47-1+rpt4" } ] }, "database_specific": { "per_version": { "1:6.1.47-1+rpt4": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": null, "compiled_filter": false } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97594" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/4c37992b9668c4f37aae41dd95c369f7b6009915" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/379efd2ce8b26fd35feb13ccc2f671ff105a5052" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/ba29c46ccfe3ebadfb8aa18149186c49f84b14f8" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/2c6dc792538260a8087ac5b22c31b3b8e47c85d6" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-10-03T11:04:09Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.8, "cvss_v3_severity": "High", "scenario": "AV:L - The trigger is a local linkat(2) syscall: filename_linkat() -> security_path_link() -> hook_path_link() -> current_check_refer_path(), raced against local rename(2)/rmdir(2). No remote protocol supplies any of the input.\nAC:L - The attacker runs every side of the race: a linkat() loop on their own file, plus rename() to reparent the source and rmdir() to free the old parent, all in directories they create (e.g. /tmp). No condition outside the attacker's control is needed; the window can be retried at will.\nPR:L - An ordinary unprivileged user can enter a Landlock domain that handles any FS right (landlock_create_ruleset + landlock_restrict_self after PR_SET_NO_NEW_PRIVS, no capability needed); that makes landlock_get_applicable_subject() non-NULL and reaches the unpinned d_parent read.\nUI:N - The attacker's own syscalls on files and directories they own trigger the bug; no other user or administrator has to do anything.\nS:U - The corruption happens in kernel memory under the same kernel authority; exploiting it is standard local privilege escalation, not a crossing into a separate authority such as a hypervisor.\nC:H - collect_domain_accesses() dereferences the freed old_parent dentry and follows its d_parent/d_inode pointers into the Landlock inode blob via find_rule(). If the attacker reallocates the freed slab, they control pointers that the kernel then follows and reads.\nI:H - collect_domain_accesses() calls dget() and later dput() on the freed dentry. That writes the lockref inside the freed or reallocated object and can run dentry teardown on it, a write primitive that can lead to a double free or control-flow hijack.\nA:H - The KASAN report in the commit shows a slab use-after-free in collect_domain_accesses(). On production kernels the refcount changes on freed memory or the stale pointer walk can oops or panic the kernel." } } }