CVE-2025-68736

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

landlock: Fix handling of disconnected directories

Disconnected files or directories can appear when they are visible and

opened from a bind mount, but have been renamed or moved from the source

of the bind mount in a way that makes them inaccessible from the mount

point (i.e. out of scope).

Previously, access rights tied to files or directories opened through a

disconnected directory were collected by walking the related hierarchy

down to the root of the filesystem, without taking into account the

mount point because it couldn't be found. This could lead to

inconsistent access results, potential access right widening, and

hard-to-debug renames, especially since such paths cannot be printed.

For a sandboxed task to create a disconnected directory, it needs to

have write access (i.e. FS_MAKE_REG, FS_REMOVE_FILE, and FS_REFER) to

the underlying source of the bind mount, and read access to the related

mount point. B

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References