PT-2026-64515 · Linux · Linux
CVE-2026-64294
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
mm: do file ownership checks with the proper mount idmap
Ever since idmapped mounts were introduced, inode ownership checks (for
side-channel protection) in mincore() and madvise(MADV PAGEOUT) were done
against the nop mnt idmap, which completely ignores the file's mount's
idmap. This results in odd edgecases like:
- mount/bind-mount with an idmap userA:userB:1
- userB runs an owner or capable() check on file that is owned by userA on-disk/in-memory, but owned by userB after idmap translation
- owner or capable() mysteriously fails as the correct idmap wasn't supplied
In the case of mincore/madvise MADV PAGEOUT, this is usually benign,
because file permission(file, MAY WRITE) will probably succeed, as it uses
the proper idmap internally, but it does not need to be the case on e.g a
0444 file where even the owner itself doesn't have permissions to write to
it.
Since this is clearly not trivial to get right, introduce a
file owner or capable() that can carry the correct semantics, and switch
the various users in mm to it.
The issue was found by manual code inspection & an off-list discussion
with Jan Kara.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux