landlock: Fix use-after-free of the source's parent directory

{
  "id": "78e8c58bb97bb68eacd3368b9a346ff742410d855d2ae15c459436beab3c0e16",
  "url": "https://osv.dev/vulnerability/CVE-2026-97594",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "landlock: Fix use-after-free of the source's parent directory",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: landlock: Fix use-after-free of the source's parent directory current_check_refer_path() reads old_dentry->d_parent without holding a reference nor a lock on it, and then dereferences it in collect_domain_accesses() and in the audit record. A reference on a child does not pin its parent: __d_move() reassigns dentry->d_parent and drops the reference the child held on its former parent. hook_path_rename() is not affected because the rename path calls lock_rename() before the hook, so the source cannot be reparented under it. hook_path_link() has no such protection: filename_linkat() holds a reference on the source dentry but neither locks nor references its parent, so a concurrent rename(2) can reparent the source while security_path_link() runs, and the former parent can then be removed and freed while the hook walks it. A process can trigger this after entering a Landlock domain that handles at least one filesystem access right. The process can then race a linkat(2) loop against rename(2) and rmdir(2): BUG: KASAN: slab-use-after-free in collect_domain_accesses+0x278/0x290 Read of size 4 at addr ffff888160bd53f4 by task llrepro2/549 collect_domain_accesses+0x278/0x290 current_check_refer_path+0x952/0x1120 security_path_link+0x1be/0x320 filename_linkat+0x342/0x6d0 __x64_sys_linkat+0xfa/0x150 Freed by task 562: kmem_cache_free+0x139/0x4c0 i_callback+0x4b/0x80 rcu_core+0x7dc/0x10a0 Take a reference on the dentry ",
    "evidence": "osv:CVE-2026-97594",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.1.191",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.160",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.112",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.53",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "7.2.7",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-97594",
      "aliases": [
        "CVE-2026-97594"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "b91c3e4ea756b12b7d992529226edce1cfd854d7"
                },
                {
                  "fixed": "0475440ff8c04be26a88733af0c85f597bb28c0a"
                },
                {
                  "fixed": "48fc1c74052c956c59d5b16b5e18e0dd36b76aa2"
                },
                {
                  "fixed": "4c37992b9668c4f37aae41dd95c369f7b6009915"
                },
                {
                  "fixed": "379efd2ce8b26fd35feb13ccc2f671ff105a5052"
                },
                {
                  "fixed": "ba29c46ccfe3ebadfb8aa18149186c49f84b14f8"
                },
                {
                  "fixed": "2c6dc792538260a8087ac5b22c31b3b8e47c85d6"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97594.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.19.0"
                },
                {
                  "fixed": "6.1.191"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.160"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.112"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.53"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "7.2.7"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97594.json"
          }
        }
      ],
      "modified": "2026-11-01T02:30:28.151933317Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/0475440ff8c04be26a88733af0c85f597bb28c0a",
        "https://git.kernel.org/stable/c/2c6dc792538260a8087ac5b22c31b3b8e47c85d6",
        "https://git.kernel.org/stable/c/379efd2ce8b26fd35feb13ccc2f671ff105a5052",
        "https://git.kernel.org/stable/c/48fc1c74052c956c59d5b16b5e18e0dd36b76aa2",
        "https://git.kernel.org/stable/c/4c37992b9668c4f37aae41dd95c369f7b6009915",
        "https://git.kernel.org/stable/c/ba29c46ccfe3ebadfb8aa18149186c49f84b14f8",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97594.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-97594",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97594.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-97594",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 492984,
  "published_at": "2026-09-25T10:22:10.548+00:00"
}