Към съдържанието
Търсене

CVE-2026-89768: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: fs: fix user path of nested backing files backing_file_open() derives the path to be stored in the new backing file from user_file->f_path. This is incorrect when user_file itself is a backing file, which is the case for nested stacking filesystems, e.g. overlayfs mounts where the lowerdir of one overlayfs is the merged directory of another. Since commit def3ae83da02 ("fs: store real path instead of fake path in backing file f_path") the f_path of a backing file holds the real path of the intermediate layer, not the path that the user opened. Commit 924577e4f6ca ("ovl: Fix nested backing file paths") fixed this for such configurations by passing file_user_path() from ovl_open_realfile(). However, commit 6af36aeb147a ("lsm: add backing_file LSM hooks") changed the first argument of backing_file_open() from the user path back to the user file and derived the path from user_file->f_path again, silently re-introducing the problem. As a result, files mapped through a nested overlayfs show the wrong path in /proc/<pid>/maps and in perf/ftrace mmap records. For example, with two nested overlayfs mounts: mkdir -p /ovl/{lower,upper,work,merged} /ovl/nested echo hello > /ovl/lower/foo mount -t overlay overlay \ -o lowerdir=/ovl/lower,upperdir=/ovl/upper,workdir=/ovl/work \ /ovl/merged # at least two lowerdirs are needed when upperdir is nonexistent mount -t overlay overlay \ -o lowerdir=/ovl/merged:/ovl/lower /ovl/nested mapping /ovl/nested/foo shows a disconnected path instead of the user path: # readlink /proc/self/fd/3 /ovl/nested/foo # grep foo /proc/self/maps 7f6e2c100000-7f6e2c101000 r--s 00000000 00:24 15813027 /foo The bogus path is derived from the f_path of the intermediate backing file, whose mount is a private clone that d_path() cannot resolve. Fix this by using file_user_path(), which returns the outermost user-visible path for backing files and falls back to &u

    Засегнати продукти

    • Linux Linux: 5b6aa9a843205da92d860e5011a7b29062a76b8f преди 88c927a63dc717b6d46b20fe13ea713916e49089; 5dfcb15974e7d0f96aca278dd9f1b85df91523ef преди c03114634d342648bd34910aa8fb88007e92cc3c; 6af36aeb147a06dea47c49859cd6ca5659aeb987 преди a35cc21355734e1acb89973d9be90ca8e4c3ed2f; 6af36aeb147a06dea47c49859cd6ca5659aeb987 преди f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d; 41c5b269af8b1f0bffcab7766a793f294ae6764e; 27e795afba0018b0ea9460dbad4bd706d1ba5ee0; 6.12.95 преди 6.12.109; 6.18.38 преди 6.18.50; 6.6.144 преди 6.7; 7.0.4 преди 7.1
    • Linux Linux: 7.1; преди 7.1; 6.12.109 до 6.12.*; 6.18.50 до 6.18.*; 7.2.4 до 7.2.*; от 7.3 нататък

    История

    • 11 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-89768: Linux | freedomonline.bg