CVE-2026-74619
Received Received - Intake

Privilege Escalation in Linux Kernel OverlayFS

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ovl: don't warn when the mount is completed from another user namespace fsopen() records the caller's user namespace in fc->user_ns and hands back an ordinary file descriptor. Nothing ties the task that calls fsconfig(FSCONFIG_CMD_CREATE) to the task that created the context. The fd is inherited across fork() and exec() and it can be passed over a unix socket. Completing a context from another user namespace is allowed on purpose. vfs_cmd_create() authorizes the create with mount_capable(), which for FS_USERNS_MOUNT checks ns_capable(fc->user_ns, CAP_SYS_ADMIN), and that succeeds for a task holding CAP_SYS_ADMIN in an ancestor of fc->user_ns. So an unprivileged task can reach the WARN_ON() in ovl_fill_super(): create a user and a mount namespace in a child, call fsopen("overlay") there, send the fscontext fd to the parent and let the parent issue FSCONFIG_CMD_CREATE. Both namespaces come from a plain unshare(1) and no capability is needed anywhere: WARNING: fs/overlayfs/super.c:1551 at ovl_fill_super+0x7b9/0x1e20 [overlay] CPU: 3 UID: 1000 PID: 3243376 Comm: fswarn Call Trace: get_tree_nodev+0x71/0xa0 ovl_get_tree+0x15/0x20 [overlay] vfs_get_tree+0x2a/0x100 vfs_cmd_create+0x60/0xf0 __do_sys_fsconfig+0x4b2/0x500 The child needs the mount namespace because fsopen() itself gates on may_mount(), which asks for CAP_SYS_ADMIN in the user namespace owning the caller's mount namespace. fsconfig() doesn't repeat that check. It is a WARN_ON() and not a WARN_ON_ONCE(), so the condition can be raised in a loop to taint the kernel and flood the log, and it panics a kernel booted with panic_on_warn. Keep refusing the mount and stop warning about it. ovl_parse_param() already spells a user namespace check this way for Opt_override_creds.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74619
EUVD
EUVD-2026-64556

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a warning in the Linux kernel's overlay filesystem (ovl) when a mount is completed from a different user namespace. The issue occurs because fsopen() allows the file descriptor to be passed between processes, including across user namespaces. An unprivileged task can trigger a warning by creating a mount namespace, calling fsopen(), and passing the file descriptor to a parent process that completes the mount. The warning is unnecessary because the operation is allowed by design.

Detection Guidance

This vulnerability is specific to the Linux kernel's overlay filesystem (ovl) and does not have a direct network detection method. To check if your system is affected, verify the kernel version and whether the overlay filesystem module is loaded. Use commands like 'uname -r' to check the kernel version and 'lsmod | grep overlay' to see if the overlay module is loaded.

Impact Analysis

The main impact is potential kernel tainting and log flooding due to repeated warnings. In extreme cases, it could trigger a kernel panic if the system is configured to panic on warnings. This could lead to system instability or crashes, especially in environments where unprivileged users can manipulate mount namespaces.

Mitigation Strategies

Apply the latest kernel security updates provided by your Linux distribution to patch this vulnerability. If you cannot update immediately, consider disabling the overlay filesystem module by running 'modprobe -r overlay' as a temporary workaround. Ensure no unprivileged users have access to mount namespaces or CAP_SYS_ADMIN capabilities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74619. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart