SB20260912228 - Missing Authorization in Linux kernel landlock

Description

This security bulletin contains information about 1 vulnerability.

1) Missing Authorization (CVE-ID: CVE-2026-89560)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass Landlock filesystem access restrictions.

The vulnerability exists due to improper access control in Landlock whiteout creation checks when creating whiteout objects with mknod(2) or renameat2(2) using RENAME_WHITEOUT. A local user can create a whiteout object despite denied required Landlock access rights to bypass Landlock filesystem access restrictions.

Normal renames within layered OverlayFS mounts are not affected.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0c3204aacbe8c07f9e87e3028f28ec6c166a1075
• https://git.kernel.org/stable/c/627ce4902df1d737e99306daae5a87c68b876d16
• https://git.kernel.org/stable/c/672fa082d48b21e1fb62cdb184fee41513e53421