Technical Summary

The Linux kernel vulnerability CVE-2025-68736 involves improper handling of disconnected directories in the landlock security subsystem. Disconnected directories arise when files or directories visible through a bind mount are renamed or moved such that they become inaccessible from the mount point. Previously, access rights for files opened through such disconnected directories were determined by traversing the filesystem hierarchy up to the root without considering the mount point, which could not be found. This flaw could cause inconsistent access control results and potential widening of access rights, complicating security enforcement and debugging. To create a disconnected directory, an attacker must have write access (FS_MAKE_REG, FS_REMOVE_FILE, FS_REFER) to the bind mount source and read access to the mount point. The vulnerability has been addressed in Linux kernel updates, with patches available in multiple Ubuntu kernel package versions. The CVSS 3.1 score is 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating a high severity vulnerability with local attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability.