CVE-2025-68736

A flaw was found in the Linux kernel's Landlock security module. When handling files or directories accessed through disconnected directories (created via bind mounts after rename/move operations), Landlock incorrectly collected access rights by walking the filesystem hierarchy instead of respecting the mount point boundaries. This could lead to inconsistent access decisions and potential access right widening during rename operations.

This flaw affects sandboxed applications using Landlock for filesystem access control. A sandboxed task with specific permissions on bind mount sources could potentially gain inconsistent access rights through disconnected directories. The vulnerability requires the ability to create bind mounts and perform specific rename operations, limiting practical exploitability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.