Linux Kernel CVE-2026-97594

Exploitation requires local code execution and that the attacking process has entered a Landlock domain configured to handle at least one filesystem access right - without an active Landlock ruleset the vulnerable current_check_refer_path()/hook_path_link() path is not reached. The attacker must then win a race: a linkat(2) loop must overlap with rename(2)/rmdir(2) reparenting and freeing the source dentry's former parent while security_path_link() runs. Limiting factors: local access only (AV:L), low but non-zero privileges to invoke syscalls and set up a Landlock domain (PR:L), a timing-sensitive race window (raising real-world attack complexity), and the fact that the sibling rename hook (hook_path_rename) is already protected by lock_rename() so only the link path is exploitable.

Signals conflict sharply. The NVD CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H) portrays a high-impact local flaw with full confidentiality/integrity/availability loss, but the description contradicts this: the root cause is a use-after-free READ of a freed parent dentry in collect_domain_accesses() reached via a narrow race between linkat(2) and rename(2)/rmdir(2). A race window makes AC:H more honest than the assigned AC:L, and the primary consequence is a KASAN-detected slab-use-after-free that manifests as a kernel crash - availability loss - rather than the confidentiality/integrity compromise implied by C:H/I:H. No EPSS score, no CISA KEV listing, and no public exploit are present in the input, so there is no signal of active or automatable exploitation. The Tags field labels this 'Information Disclosure,' which is inconsistent with the actual UAF/DoS nature (the freed read is not an attacker-controlled disclosure primitive). Net: this is a legitimate memory-safety bug worth patching on affected hosts, but it is a low-real-world-priority, local, race-gated denial-of-service - not the critical remote threat the 7.8 suggests. A weaponizable UAF-to-code-execution path is not demonstrated in the provided data and should not be assumed.

A local unprivileged user runs a process that has entered a Landlock domain handling at least one filesystem access right, then executes a tight loop calling linkat(2) on a source file while a second thread races rename(2) and rmdir(2) to reparent and free the source's former parent directory during the security_path_link() hook. The freed dentry is then dereferenced by the LSM hook, producing a use-after-free read and typically a kernel crash. No public proof-of-concept is identified in the provided data; the reporter demonstrated the flaw via a KASAN reproducer (llrepro2).