CVE-2026-89560

A flaw was found in the Linux kernel's Landlock security module. This vulnerability allowed for the creation of 'whiteout' objects without proper permission checks. Whiteout objects are special files used in OverlayFS to hide underlying files, and their unauthorized creation could lead to unexpected file system behavior or bypass security restrictions. A local attacker could exploit this by using specific mknod(2) or renameat2(2) system calls.

Landlock did not consistently require the expected MAKE_REG permission when a sandboxed process created OverlayFS whiteout objects. In the renameat2 RENAME_WHITEOUT path, a directory entry could be created even when all LANDLOCK_ACCESS_FS_MAKE_* rights were denied, which makes this a local access control bypass rather than a memory corruption issue. For the CVSS the PR:L value is used because the attacker must already be able to run local code in a Landlock restricted process and reach the relevant filesystem operation. The issue is not network reachable. Impact is mainly low integrity impact through unauthorized whiteout creation and possible policy bypass. A low availability impact is defensible in the paranoid score because whiteouts can hide lower layer files in an OverlayFS view and may disrupt sandboxed workloads.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.