CVE-2026-97594

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

landlock: Fix use-after-free of the source's parent directory

current_check_refer_path() reads old_dentry->d_parent without holding a

reference nor a lock on it, and then dereferences it in

collect_domain_accesses() and in the audit record.

A reference on a child does not pin its parent: __d_move() reassigns

dentry->d_parent and drops the reference the child held on its former

parent. hook_path_rename() is not affected because the rename path

calls lock_rename() before the hook, so the source cannot be reparented

under it. hook_path_link() has no such protection: filename_linkat()

holds a reference on the source dentry but neither locks nor references

its parent, so a concurrent rename(2) can reparent the source while

security_path_link() runs, and the former parent can then be removed and

freed while the hook walks it.

A process can trigger this after entering a Landlock domain that handles

at least one filesyst

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References