sandboxec

sandboxec A lightweight command sandbox for Linux, built on Landlock. No daemon. No root. No image build step. Use it to run risky commands with a tighter blast radius: third-party CLIs, untrusted scripts, generated code, and one-off tooling. Purpose Running untrusted code is often an...

CVE-2026-89560

A flaw was found in the Linux kernel's Landlock security module. This vulnerability allowed for the creation of 'whiteout' objects without proper permission checks. Whiteout objects are special files used in OverlayFS to hide underlying files, and their unauthorized creation could lead to...

CVE-2026-89560

In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCKACCESSFSMAKEREG for whiteout creation Whiteout objects are used in the upper layer of an OverlayFS to indicate that the file with this name does not exist in the unified view, even if it is present in on...

CVE-2026-89560 landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation

In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCKACCESSFSMAKEREG for whiteout creation Whiteout objects are used in the upper layer of an OverlayFS to indicate that the file with this name does not exist in the unified view, even if it is present in on...

CVE-2026-89560 landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation

In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCKACCESSFSMAKEREG for whiteout creation Whiteout objects are used in the upper layer of an OverlayFS to indicate that the file with this name does not exist in the unified view, even if it is present in on...

EUVD-2026-76471

In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCKACCESSFSMAKEREG for whiteout creation Whiteout objects are used in the upper layer of an OverlayFS to indicate that the file with this name does not exist in the unified view, even if it is present in on...

CVE-2026-89560

CVE-2026-89560 affects the Linux kernel Landlock security module , specifically the permission checks for whiteout object creation in the upper layer of OverlayFS (fuse-overlayfs). Two flaws exist: first, mknod(2) with S_IFCHR/makedev(0,0) was guarded by LANDLOCK_ACCESS_FS_MAKE_CHAR instead of th...

PT-2026-90276

In the Linux kernel, the following vulnerability has been resolved: landlock: Require LANDLOCK ACCESS FS MAKE REG for whiteout creation Whiteout objects are used in the upper layer of an OverlayFS to indicate that the file with this name does not exist in the unified view, even if it is present i...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fscrypt: destroy keyring after securitysbdelete The function fscryptDestroykeyring must be called after all potentially-encrypted inodes have been evicted; otherwise, it cannot safely destroy the keyring. Since inodes that are...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: landlock: Handle weird files A corrupted filesystem e.g., bcachefs might return weird files. Instead of throwing a warning and allowing access to such files, treat them as regular files...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: samples/landlock: Fixed the memory leak in pathlist. Clang static analysis reports this error. sandboxer.c:134:8: Warning: Potential memory leak pointed to by ‘pathlist’. ret = 0; ^ pathlist is allocated in parsepath, but never...

Linux Distros Unpatched Vulnerability : CVE-2026-72183

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - landlock: Fix LANDLOCKSCOPESIGNAL bypass on the SIGIO path LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock...

CVE-2026-72183

A flaw was found in the Linux kernel's Landlock security module. A sandboxed process can bypass the intended signal isolation provided by LANDLOCKSCOPESIGNAL. By manipulating file descriptors with specific fcntl calls and asynchronous I/O SIGIO delivery, a local attacker can send signals, such as...

CVE-2026-72183

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCKSCOPESIGNAL bypass on the SIGIO path LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery path...

UBUNTU-CVE-2026-72183

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCKSCOPESIGNAL bypass on the SIGIO path LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery path...

CVE-2026-72183

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCKSCOPESIGNAL bypass on the SIGIO path LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery path...

CVE-2026-72183 landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCKSCOPESIGNAL bypass on the SIGIO path LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery path...

CVE-2026-72183 landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCKSCOPESIGNAL bypass on the SIGIO path LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery path...

CVE-2026-72183

CVE-2026-72183 concerns a Linux kernel LANDLOCK bypass on the SIGIO path. The vulnerability allowed a sandboxed process that owns a file/socket to arm fcntl(F_SETOWN), F_SETSIG and O_ASYNC so that an I/O event would deliver a chosen signal to the entire process group, potentially affecting non-sa...

EUVD-2026-58941

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCKSCOPESIGNAL bypass on the SIGIO path LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery path...