CVE-2026-97594

A flaw was found in the Linux kernel's Landlock security module. A missing reference lock allows a race condition to occur when validating directory permissions during file linking operations. A local attacker could exploit this by executing concurrent file link and rename requests to trigger a use-after-free condition, potentially resulting in a Denial of Service (DoS) via a system crash or privilege escalation.

This vulnerability is rated as Moderate severity because successful exploitation requires local unprivileged access and precise synchronization to win a tight race condition. On Red Hat Enterprise Linux systems supporting the Landlock security framework, an unprivileged user must deliberately enter a restricted domain and initiate concurrent file linking and path renaming operations to trigger memory corruption. Because this flaw cannot be initiated across the network and system stability impacts are limited to local execution contexts, the overall risk is reduced.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.