A flaw in the Linux kernel Landlock security module allows local authenticated users to bypass filesystem access restrictions during OverlayFS whiteout creation, potentially leading to unauthorized integrity impacts.

The Landlock Linux Security Module incorrectly enforced permissions for OverlayFS whiteout objects, which are used to mask files in unified views. An authenticated local attacker with low privileges can leverage this improper permission check to create whiteout objects without the required LANDLOCK_ACCESS_FS_MAKE_REG access, effectively bypassing intended filesystem restrictions.

Successful exploitation of this vulnerability allows an attacker to manipulate the filesystem view in an OverlayFS environment. While the vulnerability requires local access, the ability to bypass security policies can lead to unauthorized file integrity changes or system state inconsistencies. Given the CVSS score of 8.4, the risk is significant for multi-user environments or containerized deployments relying on Landlock for process isolation.

Immediate Action: Update the Linux kernel to version 6.18.50, 7.2.4, or later versions as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for unusual mknod or renameat2 syscall patterns, particularly those originating from unauthorized processes or users within isolated environments.

Compensating Controls: Restrict access to the system for untrusted local users and ensure that container runtimes are configured with strict security profiles to mitigate potential sandbox escapes.

Public Exploit Available: Unknown

This vulnerability represents a critical security gap in process isolation within the Linux kernel. Administrators of systems utilizing Landlock for security enforcement should prioritize patching their kernel environments to the specified fixed versions immediately to restore mandatory access control integrity.