CVE-2024-40938

What it actually does

Incorrect d_parent handling in collect_domain_accesses() allows WARN_ON_ONCE() to trigger on link operations involving a root mount point, bypassing intended Landlock domain access checks before VFS validation occurs.

Why it matters to the business

Systems relying on Landlock for process sandboxing face potential authorization bypass risks that could allow unauthorized file linking on mounted roots, increasing exposure in containerized or restricted Linux environments; low exploitability but requires kernel updates across many distributions.

How an attack unfolds

An attacker with local access crafts a link operation targeting a source directory that is a mount root; the flawed d_parent walk in Landlock triggers before the VFS security_path_link() check can enforce restrictions, potentially allowing the operation despite policy.

How to fix it

Update Linux kernel to commit b6e5e696435832b33e40775f060ef5c95f4fda1f or later stable releases containing the fix; rebuild and deploy custom kernels if using git sources; apply distribution patches promptly given the 823 days since publication.

How to confirm the fix worked

Verify kernel source contains b6e5e696435832b33e40775f060ef5c95f4fda1f; confirm absence of WARN_ON_ONCE in collect_domain_accesses for root mount link attempts via targeted test cases or code review; monitor for updated package versions in distributions.

Typical attack path

1. Gain local access on a Landlock-enabled Linux system
2. Identify or create a mount point used as source directory
3. Issue link syscall or equivalent that exercises collect_domain_accesses()
4. Trigger WARN_ON_ONCE condition before VFS enforcement
5. Achieve link operation outside intended Landlock domain restrictions

How to detect it

Search kernel logs for WARN_ON_ONCE messages referencing collect_domain_accesses or d_parent; inspect audit trails for unusual link syscalls involving mount roots on systems with Landlock enabled; review threat actor reports on Linux kernel exploitation for similar patterns.

• collect_domain_accesses
• WARN_ON_ONCE.*d_parent
• security_path_link

What your security team should do

• Prioritize kernel upgrades to the fixed commit across all affected Linux deployments
• Audit Landlock policies and mount configurations for root directory usage
• Enable kernel logging for Landlock warnings to detect similar conditions
• Test link operations in sandboxed environments post-update