Executive brief
The Linux kernel's Landlock security module, which enforces fine-grained file system access control, failed to properly restrict the creation of whiteout objects used by overlay file systems. An attacker could bypass Landlock policies to create whiteout entries, potentially circumventing intended file access restrictions and gaining unauthorized visibility or control over the file system namespace.
Technical details
The vulnerability is a privilege escalation in the Linux kernel's Landlock LSM when handling whiteout object creation via two code paths: mknod(2) with S_IFCHR and makedev(0,0), and renameat2(2) with RENAME_WHITEOUT. Previously, whiteout creation was guarded by the LANDLOCK_ACCESS_FS_MAKE_CHAR right, but whiteouts are semantically equivalent to regular file creation (not device creation) and should be guarded by LANDLOCK_ACCESS_FS_MAKE_REG. Additionally, renameat2(2) with RENAME_WHITEOUT could create directory entries even when all LANDLOCK_ACCESS_FS_MAKE_* rights were denied, bypassing the security model entirely. The fix changes the permission check from MAKE_CHAR to MAKE_REG and adds proper authorization validation for the renameat2 path. The attack requires local access to the system with ability to invoke the affected syscalls, but no special privileges beyond what a regular unprivileged user can do.
Affected products
- Linux Linux kernel versions prior to the patch
Timeline
- 2026-09-11: disclosed: CVE-2026-89560 disclosed