CVE-2026-97594: landlock: Fix use-after-free of the source's parent directory

CVE-2026-97594: landlock: Fix use-after-free of the source's parent directory

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

landlock: Fix use-after-free of the source's parent directory

current_check_refer_path() reads old_dentry->d_parent without holding a
reference nor a lock on it, and then dereferences it in
collect_domain_accesses() and in the audit record.

A reference on a child does not pin its parent: __d_move() reassigns
dentry->d_parent and drops the reference the child held on its former
parent.  hook_path_rename() is not affected because the rename path
calls lock_rename() before the hook, so the source cannot be reparented
under it.  hook_path_link() has no such protection: filename_linkat()
holds a reference on the source dentry but neither locks nor references
its parent, so a concurrent rename(2) can reparent the source while
security_path_link() runs, and the former parent can then be removed and
freed while the hook walks it.

A process can trigger this after entering a Landlock domain that handles
at least one filesystem access right.  The process can then race a
linkat(2) loop against rename(2) and rmdir(2):

  BUG: KASAN: slab-use-after-free in collect_domain_accesses+0x278/0x290
  Read of size 4 at addr ffff888160bd53f4 by task llrepro2/549
   collect_domain_accesses+0x278/0x290
   current_check_refer_path+0x952/0x1120
   security_path_link+0x1be/0x320
   filename_linkat+0x342/0x6d0
   __x64_sys_linkat+0xfa/0x150
  Freed by task 562:
   kmem_cache_free+0x139/0x4c0
   i_callback+0x4b/0x80
   rcu_core+0x7dc/0x10a0

Take a reference on the dentry selected as the source parent, using
dget() for the common-mount-root case and dget_parent() otherwise.
Release it after the hierarchy walk and synchronous audit logging.

[mic: Clarify the caller, reachability, and reference handling]

The Linux kernel CVE team has assigned CVE-2026-97594 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.19 with commit b91c3e4ea756b12b7d992529226edce1cfd854d7 and fixed in 6.18.53 with commit 379efd2ce8b26fd35feb13ccc2f671ff105a5052
	Issue introduced in 5.19 with commit b91c3e4ea756b12b7d992529226edce1cfd854d7 and fixed in 7.2.7 with commit ba29c46ccfe3ebadfb8aa18149186c49f84b14f8
	Issue introduced in 5.19 with commit b91c3e4ea756b12b7d992529226edce1cfd854d7 and fixed in 7.3-rc3 with commit 2c6dc792538260a8087ac5b22c31b3b8e47c85d6

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-97594
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	security/landlock/fs.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/379efd2ce8b26fd35feb13ccc2f671ff105a5052
	https://git.kernel.org/stable/c/ba29c46ccfe3ebadfb8aa18149186c49f84b14f8
	https://git.kernel.org/stable/c/2c6dc792538260a8087ac5b22c31b3b8e47c85d6