CVE-2025-68736: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68736 is a security flaw in the Linux kernel's Landlock security module related to improper handling of disconnected directories. When files or directories are visible and opened through a bind mount but have been renamed or moved out of scope from the mount point's source, Landlock incorrectly collected access rights by walking the filesystem hierarchy down to the root without accounting for the mount point. This could lead to inconsistent access results and potential access right widening within sandboxed tasks. The vulnerability was published on December 24, 2025, and affects the Linux kernel; it carries an estimated CVSS severity of Medium with an EPSS score of 0.000150 (Feedly).

The root cause is improper access control logic (CWE-284) in the Landlock LSM when processing disconnected directories — those accessible via a bind mount but moved or renamed out of scope from the mount source. Previously, Landlock walked the filesystem hierarchy to the root to collect access rights without being able to identify the relevant mount point, causing it to inherit permissions from the hidden filesystem hierarchy rather than the correct mount point hierarchy. A sandboxed task exploiting this condition would need write access (FS_MAKE_REG, FS_REMOVE_FILE, and FS_REFER) to the bind mount's underlying source and read access to the related mount point. The fix ensures Landlock correctly handles files and directories opened from disconnected directories by treating them as having no Landlock access rights, preventing unintended permission inheritance (Feedly).

Successful exploitation could allow a sandboxed task to gain access rights beyond those defined by its Landlock domain, effectively widening its permissions in an inconsistent and hard-to-debug manner. This primarily affects the integrity and confidentiality of the Landlock sandbox boundary, potentially allowing a confined process to access files or directories it should not be permitted to reach. The impact is limited to systems using Landlock sandboxing and requires the attacker to already have a foothold within a sandboxed process with specific write and read permissions to the bind mount (Feedly).

The Linux kernel maintainers have resolved this vulnerability with patches committed to stable kernel branches (commits 49c9e09d961025b22e61ef9ad56aa1c21b6ce2f1, 426d5b681b2f3339ff04da39b81d71176dc8c87c, and cadb28f8b3fd6908e3051e86158c65c3a8e1c907). Multiple Linux distributions have issued updated kernel packages, including Ubuntu (USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, USN-8257-1), Debian (DSA-6238-1, linux 6.12.85+1), SUSE (SUSE-2026-0962-1), and Amazon Linux 2023 (ALAS2023-2026-1646). Administrators should update to the patched kernel version provided by their distribution as soon as possible (Ubuntu Advisory, Debian Tracker, Amazon Linux).