The vulnerability arises from a use‑after‑free condition when a Landlock domain performs a link operation on a file whose parent directory may be re‑parented concurrently by a rename or rmdir. The routine reads the parent dentry without holding a reference or a lock, dereferencing a freed pointer. This can corrupt kernel memory, leading to a kernel panic or arbitrary code execution, a vulnerability that enables privilege escalation.

All Linux kernel releases in which the Landlock security module contains the unpatched current_check_refer_path routine. The patch is applied in the upstream Linux kernel, so any kernel version prior to the commit containing the fix is affected.

The exploit requires local access to a process running within a Landlock domain that has at least one filesystem access right. The attacker must race a linkat(2) call against rename(2) or rmdir(2) so that the source dentry can be re‑parented while the kernel walks the directory hierarchy. The local attacker can then trigger a use‑after‑free that corrupts kernel memory, potentially leading to kernel panic or arbitrary code execution. The CVSS score of 7.8 indicates a high severity of memory corruption, and the EPSS score is < 1%, while the vulnerability is not listed in the CISA KEV catalog, indicating no publicly observed exploitation yet. However, the local attack vector and the severity score mean the risk remains significant.