PT-2026-64515 · Linux · Linux
CVE-2026-64294
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
mm: do file ownership checks with the proper mount idmap
Ever since idmapped mounts were introduced, inode ownership checks (for
side-channel protection) in mincore() and madvise(MADV PAGEOUT) were done
against the nop mnt idmap, which completely ignores the file's mount's
idmap. This results in odd edgecases like:
- mount/bind-mount with an idmap userA:userB:1
- userB runs an owner or capable() check on file that is owned by userA on-disk/in-memory, but owned by userB after idmap translation
- owner or capable() mysteriously fails as the correct idmap wasn't supplied
In the case of mincore/madvise MADV PAGEOUT, this is usually benign,
because file permission(file, MAY WRITE) will probably succeed, as it uses
the proper idmap internally, but it does not need to be the case on e.g a
0444 file where even the owner itself doesn't have permissions to write to
it.
Since this is clearly not trivial to get right, introduce a
file owner or capable() that can carry the correct semantics, and switch
the various users in mm to it.
The issue was found by manual code inspection & an off-list discussion
with Jan Kara.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux