Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-74619

ovl: don't warn when the mount is completed from another user namespace

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: ovl: don't warn when the mount is completed from another user namespace fsopen() records the caller's user namespace in fc->user_ns and hands back an ordinary file descriptor. Nothing ties the task that calls fsconfig(FSCONFIG_CMD_CREATE) to the task that created the context. The fd is inherited across fork() and exec() and it can be passed over a unix socket. Completing a context from another user namespace is allowed on purpose. vfs_cmd_create() authorizes the create with mount_capable(), which for FS_USERNS_MOUNT checks ns_capable(fc->user_ns, CAP_SYS_ADMIN), and that succeeds for a task holding CAP_SYS_ADMIN in an ancestor of fc->user_ns. So an unprivileged task can reach the WARN_ON() in ovl_fill_super(): create a user and a mount namespace in a child, call fsopen("overlay") there, send the fscontext fd to the parent and let the parent issue FSCONFIG_CMD_CREATE. Both namespaces come from a plain unshare(1) and no capability is needed anywhere: WARNING: fs/overlayfs/super.c:1551 at ovl_fill_super+0x7b9/0x1e20 [overlay] CPU: 3 UID: 1000 PID: 3243376 Comm: fswarn Call Trace: get_tree_nodev+0x71/0xa0 ovl_get_tree+0x15/0x20 [overlay] vfs_get_tree+0x2a/0x100 vfs_cmd_create+0x60/0xf0 __do_sys_fsconfig+0x4b2/0x500 The child needs the mount namespace because fsopen() itself gates on may_mount(), which asks for CAP_SYS_ADMIN in the user namespace owning the caller's mount namespace. fsconfig() doesn't repeat that check. It is a WARN_ON() and not a WARN_ON_ONCE(), so the condition can be raised in a loop to taint the kernel and flood the log, and it panics a kernel booted with panic_on_warn. Keep refusing the mount and stop warning about it. ovl_parse_param() already spells a user namespace check this way for Opt_override_creds.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 1784fbc2ed9c888ea4e895f30a53207ed7ee8208 to < 513478092966dc9818d96dd2b3ed613fd2f6e30eaffected
  • 1784fbc2ed9c888ea4e895f30a53207ed7ee8208 to < 494346f2aab2489d379d43ff614aea447cf4e94daffected
  • 1784fbc2ed9c888ea4e895f30a53207ed7ee8208 to < be161fa31e3e9cc828a3c1bd935edca461e8a7a1affected
  • 1784fbc2ed9c888ea4e895f30a53207ed7ee8208 to < 42d99fcd8006007e2f708bede6789f37f3910b30affected
  • 1784fbc2ed9c888ea4e895f30a53207ed7ee8208 to < 63981fc786daaa626cb14d9be1406f674d79f98faffected

Linux Linux

Default version status: affected

  • 6.5affected
  • 0 to < 6.5unaffected
  • 6.6.152 to ≤ 6.6.*unaffected
  • 6.12.104 to ≤ 6.12.*unaffected
  • 6.18.45 to ≤ 6.18.*unaffected
  • 7.1.9 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References