CVE-2026-74595
Received Received - Intake

fscrypt Policy Set Permission Bypass via Mount IDMAP

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy() fscrypt_ioctl_set_policy() calls inode_owner_or_capable() with &nop_mnt_idmap before allowing an encryption policy to be set, instead of the idmap of the mount the ioctl was issued on. fscrypt is used by filesystems that support idmapped mounts (e.g. ext4, f2fs), so on such a mount this compares the caller's fsuid against the unmapped on-disk owner rather than the mapped owner: the actual owner can be wrongly denied with -EACCES and an unrelated caller wrongly allowed. Use file_mnt_idmap(filp) instead.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74595
EUVD
EUVD-2026-64532

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel fscrypt *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel affects fscrypt, a filesystem encryption feature. The issue is in the fscrypt_ioctl_set_policy() function, which incorrectly checks file ownership using the wrong mount ID mapping. Instead of using the mount's ID map where the ioctl was issued, it uses a default one, leading to incorrect permission checks.

Detection Guidance

This vulnerability is specific to the Linux kernel's fscrypt component and requires kernel-level detection. Check if your system uses filesystems like ext4 or f2fs with idmapped mounts enabled. Inspect kernel logs for fscrypt-related errors or EACCES denials during encryption policy changes. No direct network detection commands are applicable.

Impact Analysis

This flaw could allow unauthorized users to set encryption policies on files they do not own, potentially leading to data access issues or unauthorized encryption. Legitimate users might be denied permission to set encryption policies on their own files due to incorrect ownership checks.

Mitigation Strategies

Apply the latest Linux kernel security updates to patch this issue. If immediate patching is not possible, avoid using idmapped mounts with fscrypt-enabled filesystems until the fix is applied. Monitor for unusual access denials in fscrypt operations as a potential indicator of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74595. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart