CVE-2026-64294
Received Received - Intake

Ownership Check Bypass in Linux Kernel mm Subsystem

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mm: do file ownership checks with the proper mount idmap Ever since idmapped mounts were introduced, inode ownership checks (for side-channel protection) in mincore() and madvise(MADV_PAGEOUT) were done against the nop_mnt_idmap, which completely ignores the file's mount's idmap. This results in odd edgecases like: 1) mount/bind-mount with an idmap userA:userB:1 2) userB runs an owner_or_capable() check on file that is owned by userA on-disk/in-memory, but owned by userB after idmap translation 3) owner_or_capable() mysteriously fails as the correct idmap wasn't supplied In the case of mincore/madvise MADV_PAGEOUT, this is usually benign, because file_permission(file, MAY_WRITE) will probably succeed, as it uses the proper idmap internally, but it does not need to be the case on e.g a 0444 file where even the owner itself doesn't have permissions to write to it. Since this is clearly not trivial to get right, introduce a file_owner_or_capable() that can carry the correct semantics, and switch the various users in mm to it. The issue was found by manual code inspection & an off-list discussion with Jan Kara.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64294
EUVD
EUVD-2026-49006

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect file ownership checks when using idmapped mounts. The system fails to properly apply the mount's user ID mapping during checks in functions like mincore() and madvise(MADV_PAGEOUT). This can lead to unexpected permission failures where a user's access rights are miscalculated due to missing idmap translation.

Detection Guidance

This vulnerability is specific to the Linux kernel's handling of idmapped mounts and file ownership checks. Detection requires verifying kernel versions and checking for affected functions like mincore() and madvise(MADV_PAGEOUT). Use uname -a to check kernel version and audit kernel logs for idmap-related errors. No direct commands detect this flaw without kernel inspection.

Impact Analysis

The impact depends on how idmapped mounts are used. In most cases, it may cause unexpected permission denials for file operations, especially on files with restrictive permissions like 0444. Users might find they cannot access files they should have rights to due to incorrect ownership checks.

Mitigation Strategies

Apply the latest kernel patches from your distribution to resolve the issue. Avoid using idmapped mounts with user namespaces until patched. Monitor kernel updates and restart services after patching. If idmapped mounts are necessary, restrict their use to trusted users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64294. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart