Executive brief
A vulnerability in the Linux kernel's Landlock security module could allow sandboxed applications to bypass certain file access restrictions. Under specific conditions involving bind mounts and renamed directories, a restricted program might gain more permissions than intended, potentially allowing it to move or rename files it should not have access to. This issue primarily affects systems using Landlock for application sandboxing.
Technical details
A vulnerability in the Landlock LSM (Linux Security Module) arises from the improper handling of disconnected directories—files or directories that become inaccessible from their original mount point due to renames or moves outside the bind mount scope. Previously, Landlock's hierarchy walk for access right collection failed to account for the mount point when it couldn't be found in the path, potentially inheriting permissions from the underlying filesystem root instead of the restricted mount hierarchy. This could lead to inconsistent access results and the widening of access rights, specifically during 'refer' (rename/link) operations. The fix ensures that the hierarchy walk includes both the filesystem hierarchy and the specific mount point from which the disconnected directory was opened. Affected versions range from the introduction of Landlock in 5.13 up to fixed releases in the 6.12.y and 6.18.y branches.
Affected products
- Linux Linux Kernel 5.13 to 6.18.2
Timeline
- 2025-12-24: disclosed: CVE published date
- 2025-11-28: patched: Initial fix commit in Landlock tree