CVE-2026-68448

Received Received - Intake

Overlayfs Cross-SB Copy File Access Validation Flaw

Publication date: 2026-08-12

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copy_file_range source with src mounter creds Commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices") allowed filesystems that implement the copy_file_range() f_op to decide if they want to access cross-sb copy from/to the same fs type. The same commit added checks to verify same sb copy for filesystems that implement ->copy_file_range() and do not support cross-sb copy at the time, namely, to ceph, fuse and nfs. The two remaining fs which implement ->copy_file_range(), cifs and overlayfs started to support cross-sb copy from this time. While overlayfs does support cross-sb copy when the two underlying files are on the same base fs, the copy operation on the two real files from two different overalyfs filesystems is performed with the mounter creds of the destination overlayfs and the read permission access hook for the source file was called with the wrong creds. This could cause either deny of access to copy which would otherwise be allowed (e.g. with splice) or allow read access to file which would otherwise be denied. Fix the latter case by explicitly verifying read access to source file with the source overlayfs mounter creds. The former case remains a quirk of cross-sb overlayfs copy, but userspace could fall back to regular copy so no harm done.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-17

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-68448

EUVD

EUVD-2026-57054

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*
ceph	ceph	*
fuse	fuse	*
nfs	nfs	*
cifs	cifs	*
overlayfs	overlayfs	*
linux_kernel	linux_kernel	to 5dae222a5ff0 (exc)
linux_kernel	overlayfs	*
linux_kernel	cifs	*
linux_kernel	ceph	*
linux_kernel	fuse	*
linux_kernel	nfs	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves overlayfs, a filesystem that combines multiple directories into one. When copying files across different overlayfs mounts, the system checks read permissions using the wrong credentials. This can lead to two issues: denying access to files that should be readable or allowing access to files that should be restricted.

Detection Guidance

This vulnerability affects overlayfs in the Linux kernel and involves improper access control during copy_file_range operations. Detection requires checking kernel versions and overlayfs behavior. Use 'uname -r' to check kernel version and examine overlayfs mount options. Look for cross-sb copy attempts between different overlayfs instances. No direct commands detect this specific flaw, but monitoring for failed copy operations or permission denials may indicate issues.

Impact Analysis

If exploited, this flaw could allow unauthorized access to sensitive files or prevent legitimate access to files you own. Attackers might read restricted data or disrupt normal file operations. Userspace workarounds like regular copy methods can mitigate some risks.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations using affected Linux kernels may face compliance risks if sensitive data is exposed or improperly accessed.

Mitigation Strategies

Apply the Linux kernel patch that fixes the overlayfs copy_file_range access control issue. Monitor overlayfs operations involving cross-sb copies and ensure proper access controls are enforced on source files.

Hi! I’m here to help you understand CVE-2026-68448. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70