CVE-2026-72379
Received Received - Intake

Filesystem Permission Bypass in Linux Kernel via O_TMPFILE

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid vfs_tmpfile() never checked that the caller's fsuid and fsgid map into the filesystem. On an idmapped mount whose idmapping does not cover the caller's fs{u,g}id, the ->tmpfile() instance initializes the new inode through inode_init_owner(), where mapped_fsuid()/mapped_fsgid() return INVALID_UID/INVALID_GID, and the tmpfile ends up owned by (uid_t)-1. Every other creation path already refuses this: may_o_create() (O_CREAT) and may_create_dentry() (mkdir, mknod, symlink, link) bail out with -EOVERFLOW via fsuidgid_has_mapping() precisely so that an object cannot be created with an owner the filesystem cannot represent. An O_TMPFILE is no exception: it is created I_LINKABLE and linkat(2) can splice it into the namespace afterwards, so the same guarantee must hold. Add the missing fsuidgid_has_mapping() check to vfs_tmpfile(). On a non-idmapped mount the caller's fs{u,g}id always map in the superblock's user namespace, so this is a no-op there and only takes effect on an idmapped mount that does not map the caller. It applies to every filesystem that sets FS_ALLOW_IDMAP and implements ->tmpfile() (tmpfs, ext4, btrfs, xfs, f2fs, ...), and to overlayfs, whose upper-layer tmpfile creation funnels through vfs_tmpfile() via backing_tmpfile_open().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72379
EUVD
EUVD-2026-59278

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel to 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel allows creation of O_TMPFILE files with invalid ownership when the caller's filesystem user or group IDs do not map to the filesystem. The vfs_tmpfile function did not check these mappings, leading to files owned by invalid UID/GID (-1). Other file creation paths already prevent this, but O_TMPFILE lacked the same safeguard.

Detection Guidance

This vulnerability affects the Linux kernel's handling of O_TMPFILE creation with unmapped fsuid or fsgid. Detection requires checking kernel logs for failed tmpfile creation attempts or filesystem errors related to idmapped mounts. Use commands like 'dmesg | grep -i tmpfile' or 'journalctl -k | grep -i tmpfile' to search for relevant errors.

Impact Analysis

An attacker could exploit this to create files with invalid ownership on idmapped mounts, potentially causing filesystem corruption or permission issues. Systems using idmapped mounts with filesystems like tmpfs, ext4, or btrfs may be affected. Normal operations on non-idmapped mounts remain unaffected.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this issue. If immediate patching is not possible, avoid using idmapped mounts or restrict access to filesystems that implement FS_ALLOW_IDMAP and tmpfile operations until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72379. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart