{"id":29026,"date":"2026-09-25T20:31:42","date_gmt":"2026-09-25T12:31:42","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-97594"},"modified":"2026-09-25T20:31:42","modified_gmt":"2026-09-25T12:31:42","slug":"cve-2026-97594","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-97594","title":{"rendered":"CVE-2026-97594 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nlandlock: Fix use-aft"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>landlock: Fix use-after-free of the source&#8217;s parent directory<\/p>\n<p>current_check_refer_path() reads old_dentry-&gt;d_parent without holding a<br \/>\nreference nor a lock on it, and then dereferences it in<br \/>\ncollect_domain_accesses() and in the audit record.<\/p>\n<p>A reference on a child does not pin its parent: __d_move() reassigns<br \/>\ndentry-&gt;d_parent and drops the reference the child held on its former<br \/>\nparent.  hook_path_rename() is not affected because the rename path<br \/>\ncalls lock_rename() before the hook, so the source cannot be reparented<br \/>\nunder it.  hook_path_link() has no such protection: filename_linkat()<br \/>\nholds a reference on the source dentry but neither locks nor references<br \/>\nits parent, so a concurrent rename(2) can reparent the source while<br \/>\nsecurity_path_link() runs, and the former parent can then be removed and<br \/>\nfreed while the hook walks it.<\/p>\n<p>A process can trigger this after entering a Landlock domain that handles<br \/>\nat least one filesystem access right.  The process can then race a<br \/>\nlinkat(2) loop against rename(2) and rmdir(2):<\/p>\n<p>  BUG: KASAN: slab-use-after-free in collect_domain_accesses+0x278\/0x290<br \/>\n  Read of size 4 at addr ffff888160bd53f4 by task llrepro2\/549<br \/>\n   collect_domain_accesses+0x278\/0x290<br \/>\n   current_check_refer_path+0x952\/0x1120<br \/>\n   security_path_link+0x1be\/0x320<br \/>\n   filename_linkat+0x342\/0x6d0<br \/>\n   __x64_sys_linkat+0xfa\/0x150<br \/>\n  Freed by task 562:<br \/>\n   kmem_cache_free+0x139\/0x4c0<br \/>\n   i_callback+0x4b\/0x80<br \/>\n   rcu_core+0x7dc\/0x10a0<\/p>\n<p>Take a reference on the dentry selected as the source parent, using<br \/>\ndget() for the common-mount-root case and dget_parent() otherwise.<br \/>\nRelease it after the hierarchy walk and synchronous audit logging.<\/p>\n<p>[mic: Clarify the caller, reachability, and reference handling]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>landlock: Fix use-after-free of the source&#8217;s parent directory<\/p>\n<p>current_check_refer_path() reads old_dentry-&gt;d_parent without holdin<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29026","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29026","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29026"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29026"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29026"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}