Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report
Check your stack
CVE-2026-97594

landlock: Fix use-after-free of the source's parent directory

Products / packages Linux

Published

Share

Severity and exploitation

Not in CISA KEV

KEV coverage does not rule out exploitation.

KEV checked 14/11/2026, 21:00:34 UTC
Linux · CVSS:3.1 · 7.8
Assessment vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity

high7.8

CVSS measures technical severity, not the likelihood of an attack.

Known exploitation

Not listed in the checked CISA KEV catalog

Absence from CISA KEV does not rule out attacks.

Public exploit

Not established by this record

Missing evidence does not mean no public exploit exists.

Remediation

Fix status not established

No structured fix or guidance is available here. Check the latest publisher advisory.

What this means

The Linux kernel has a use-after-free vulnerability in landlock, affecting versions 5.19 and possibly others. A process can trigger this after entering a Landlock domain that handles at least one filesystem access right. The impact is a slab-use-after-free error.

Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.

Attack conditions

No attack-condition excerpt has been identified here. Review the full source description and references for authentication, network access, and configuration requirements.

Review supporting sources →

Affected versions

Check the exact model, release, and any platform requirements against your installation.

Linux · Linux

Linux

6 ranges
Linux version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

b91c3e4ea756b12b7d992529226edce1cfd854d7 → before 0475440ff8c04be26a88733af0c85f597bb28c0a

git versions

b91c3e4ea756b12b7d992529226edce1cfd854d7 → before 48fc1c74052c956c59d5b16b5e18e0dd36b76aa2

git versions

b91c3e4ea756b12b7d992529226edce1cfd854d7 → before 4c37992b9668c4f37aae41dd95c369f7b6009915

git versions

b91c3e4ea756b12b7d992529226edce1cfd854d7 → before 379efd2ce8b26fd35feb13ccc2f671ff105a5052

git versions

b91c3e4ea756b12b7d992529226edce1cfd854d7 → before ba29c46ccfe3ebadfb8aa18149186c49f84b14f8

git versions

b91c3e4ea756b12b7d992529226edce1cfd854d7 → before 2c6dc792538260a8087ac5b22c31b3b8e47c85d6

git versions

unaffected

unknown

Other versions: unaffected

Linux · Linux

Linux

8 ranges
Linux version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

5.19

unaffected

0 → before 5.19

semver versions

6.1.191 → through 6.1.*

semver versions

6.6.160 → through 6.6.*

semver versions

6.12.112 → through 6.12.*

semver versions

6.18.53 → through 6.18.*

semver versions

7.2.7 → through 7.2.*

semver versions

7.3 → through *

original_commit_for_fix versions

unknown

Other versions: affected

Automatic dependency matching is unavailable for this record. Use the product evidence and publisher’s instructions to check your installation.

What to do

Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.

No structured fix or remediation guidance is available here. Check the full source description and vendor’s latest advisory for a patch or workaround; do not assume another version is safe.

cve.new guidance unless attributed to a publisher. This page does not inspect your installation.

Public exploit evidence

No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.

Original source description

Read the full publisher description

In the Linux kernel, the following vulnerability has been resolved:

landlock: Fix use-after-free of the source's parent directory

current_check_refer_path() reads old_dentry->d_parent without holding a reference nor a lock on it, and then dereferences it in collect_domain_accesses() and in the audit record.

A reference on a child does not pin its parent: __d_move() reassigns dentry->d_parent and drops the reference the child held on its former parent. hook_path_rename() is not affected because the rename path calls lock_rename() before the hook, so the source cannot be reparented under it. hook_path_link() has no such protection: filename_linkat() holds a reference on the source dentry but neither locks nor references its parent, so a concurrent rename(2) can reparent the source while security_path_link() runs, and the former parent can then be removed and freed while the hook walks it.

A process can trigger this after entering a Landlock domain that handles at least one filesystem access right. The process can then race a linkat(2) loop against rename(2) and rmdir(2):

BUG: KASAN: slab-use-after-free in collect_domain_accesses+0x278/0x290 Read of size 4 at addr ffff888160bd53f4 by task llrepro2/549 collect_domain_accesses+0x278/0x290 current_check_refer_path+0x952/0x1120 security_path_link+0x1be/0x320 filename_linkat+0x342/0x6d0 __x64_sys_linkat+0xfa/0x150 Freed by task 562: kmem_cache_free+0x139/0x4c0 i_callback+0x4b/0x80 rcu_core+0x7dc/0x10a0

Take a reference on the dentry selected as the source parent, using dget() for the common-mount-root case and dget_parent() otherwise. Release it after the hierarchy walk and synchronous audit logging.

[mic: Clarify the caller, reachability, and reference handling]

References

6 sources
git.kernel.org/stable/c/0475440ff8c04be26a88733af0c85f597bb28c0a
Source referenceLinux
git.kernel.org/stable/c/48fc1c74052c956c59d5b16b5e18e0dd36b76aa2
Source referenceLinux
git.kernel.org/stable/c/4c37992b9668c4f37aae41dd95c369f7b6009915
Source referenceLinux
git.kernel.org/stable/c/379efd2ce8b26fd35feb13ccc2f671ff105a5052
Source referenceLinux
git.kernel.org/stable/c/ba29c46ccfe3ebadfb8aa18149186c49f84b14f8
Source referenceLinux
git.kernel.org/stable/c/2c6dc792538260a8087ac5b22c31b3b8e47c85d6
Source referenceLinux

Inside the record

Evidence available

Package identity · not supplied
Version evidence
Remediation guidance · not supplied
Weakness classification · not supplied
Additional publishers · not supplied

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-97594

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Environment requirements

These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.

Linux · platform conditions

Any condition may hold

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.19

Before: 6.1.191

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.19

Before: 6.6.160

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.19

Before: 6.12.112

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.19

Before: 6.18.53

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.19

Before: 7.2.7

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.19

Before: 7.3

Applicability preview
[
  {
    "nodes": [
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.19",
            "versionEndExcluding": "6.1.191"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.19",
            "versionEndExcluding": "6.6.160"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.19",
            "versionEndExcluding": "6.12.112"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.19",
            "versionEndExcluding": "6.18.53"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.19",
            "versionEndExcluding": "7.2.7"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.19",
            "versionEndExcluding": "7.3"
          }
        ]
      }
    ]
  }
]
Contributing organizations · 1
Linux

Assigning organization

2026-10-30

Timeline

All times UTC

  1. Advisory published

    Publication date supplied by the source.

  2. Source updated

    Latest modification date supplied by the source.

  3. Last imported by cve.new

    Latest catalog import, not the date we first saw this advisory.

What changed

Follow changes
No substantive changes have been recorded here yet. History starts when cve.new observes a change after tracking is enabled; earlier edits are not reconstructed.

Large field values are marked as truncated previews. Original source snapshots remain retained.