CVE-2026-98215

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: selinux: preserve user SID across nested backing files SELinux saves the user file SID in a backing-file security blob so it remains available after mmap() replaces vma->vm_file with a backing file. For nested backing files (overlayfs over overlayfs, or FUSE passthrough backed by overlayfs), user_file may itself be a backing file. Its fsec->sid is the SID of the mounter that opened it, rather than the user that opened the top-level file. mprotect() then checks fd { use } against the mounter SID. This can incorrectly deny access without a domain transition, or check the wrong target SID after one. Copy the saved user SID when user_file is a backing file. Keep using the regular file SID for the first backing layer. With two nested overlayfs mounts and SELinux enforcing, mprotect(PROT_READ) returns EACCES with an fd { use } denial against the mounter SID. With this change, mprotect() succeeds. Tested on arm64 QEMU with a small BusyBox initramfs and a purpose-built SELinux policy. The original test was also repeated with Fedora Cloud Base 44 userspace and gave the same result.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98215

EUVD

EUVD-2026-93143

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	bc6c380c1159de52a252ed11f19a42c47f60a735
Linux	Linux	8bacd09f12c27710228562e4d13163e58c5f4a45
Linux	Linux	d844702198395d3f80222777030f69db6be6b709
Linux	Linux	82544d36b1729153c8aeb179e84750f0c085d3b1
Linux	Linux	82544d36b1729153c8aeb179e84750f0c085d3b1
Linux	Linux	cd0e707a927a70cdfd8bc5a512a9719a87f5ed51
Linux	Linux	6.6.144
Linux	Linux	6.12.95
Linux	Linux	6.18.38
Linux	Linux	7.0.4
Linux	Linux	7.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves SELinux incorrectly handling user file SIDs in nested backing files. When using overlayfs over overlayfs or FUSE passthrough backed by overlayfs, the user file SID may be replaced by the mounter's SID instead of the actual user's SID. This causes mprotect() to check permissions against the wrong SID, potentially denying legitimate access or allowing unauthorized access without proper domain transitions.

Detection Guidance

This vulnerability is specific to SELinux and overlayfs interactions in the Linux kernel. Detection requires checking kernel logs for SELinux denials related to mprotect() or overlayfs operations. Use 'dmesg | grep -i selinux' or 'journalctl -k | grep -i selinux' to review SELinux-related messages. If nested overlayfs mounts are used, verify if mprotect() operations fail with EACCES errors.

Impact Analysis

This vulnerability can lead to incorrect access denials when using mprotect() on files with nested backing layers. Users may experience unexpected permission errors even when they have the correct permissions. In SELinux enforcing mode, this could disrupt applications relying on proper file access controls, especially in environments using overlayfs or FUSE passthrough.

Compliance Impact

This vulnerability primarily affects SELinux access control in nested overlayfs scenarios, leading to incorrect permission denials. It does not directly impact GDPR or HIPAA compliance but could indirectly affect systems handling sensitive data by causing unauthorized access denials or failures in audit logging due to incorrect SID checks.

Mitigation Strategies

Apply the kernel patch that resolves this issue. If patching is not immediately possible, avoid using nested overlayfs mounts or disable SELinux enforcing mode temporarily with 'setenforce 0'. Monitor SELinux denials closely if mitigation is delayed.

Hi! I’m here to help you understand CVE-2026-98215. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70