Executive brief
A vulnerability in the Linux kernel's Landlock security module could allow sandboxed processes to generate unexpected audit logs. Landlock is a security feature that allows applications to restrict their own rights to prevent potential exploits from spreading. This specific issue occurs when a process attempts to mute security logging for its children; the setting is lost when a new process is created, potentially leading to operational noise or information disclosure in system logs.
Technical details
A logic error in the Landlock security module's hook_cred_transfer() function causes it to skip copying the Landlock security blob if the source credential does not have an associated domain. This behavior is inconsistent with landlock_restrict_self(), which allows setting the LOG_SUBDOMAINS_OFF flag via the ruleset_fd=-1 path without creating a domain. Consequently, when a process mutes subdomain logs and then calls fork(), the child process loses this configuration. This results in child domains producing unexpected audit records, breaking the documented behavior for sandboxed process trees. The fix involves unconditionally copying the Landlock credential blob during credential transfers.
Affected products
- Linux Linux Kernel Fixed in 1c513b8a00df, 2fcde49092aa, 874c8f83826c
Timeline
- 2026-04-07: disclosed: Initial patch submission by Mickaël Salaün
- 2026-05-27: advisory: CVE-2026-46057 published