CVE-2026-98215
- Source
- https://cve.org/CVERecord?id=CVE-2026-98215
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98215.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-98215
- Downstream
- Published
- 2026-10-06T08:44:51Z
- Modified
- 2026-10-08T02:52:53Z
- Summary
- selinux: preserve user SID across nested backing files
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
selinux: preserve user SID across nested backing files
SELinux saves the user file SID in a backing-file security blob so it remains available after mmap() replaces vma->vm_file with a backing file.
For nested backing files (overlayfs over overlayfs, or FUSE passthrough backed by overlayfs), user_file may itself be a backing file. Its fsec->sid is the SID of the mounter that opened it, rather than the user that opened the top-level file. mprotect() then checks fd { use } against the mounter SID. This can incorrectly deny access without a domain transition, or check the wrong target SID after one.
Copy the saved user SID when user_file is a backing file. Keep using the regular file SID for the first backing layer.
With two nested overlayfs mounts and SELinux enforcing, mprotect(PROT_READ) returns EACCES with an fd { use } denial against the mounter SID. With this change, mprotect() succeeds.
Tested on arm64 QEMU with a small BusyBox initramfs and a purpose-built SELinux policy. The original test was also repeated with Fedora Cloud Base 44 userspace and gave the same result.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98215.json" }- References
-
- https://git.kernel.org/stable/c/6aaeec59aadcd1eafc18b049f1b759fb6b9d9569
- https://git.kernel.org/stable/c/8c0c602202b9a4909b00bc3354e3c0355bc69e65
- https://git.kernel.org/stable/c/9d99b770e7b67b00bdef9005b928aad13e1d679b
- https://git.kernel.org/stable/c/caa1b913d90d5dc07073733326d2af0f0288f089
- https://git.kernel.org/stable/c/ff20d16b2e8230c034e21540043df47222dcc09b
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98215.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-98215
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedbc6c380c1159de52a252ed11f19a42c47f60a735Fixedcaa1b913d90d5dc07073733326d2af0f0288f089
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced8bacd09f12c27710228562e4d13163e58c5f4a45Fixed6aaeec59aadcd1eafc18b049f1b759fb6b9d9569
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedd844702198395d3f80222777030f69db6be6b709Fixed9d99b770e7b67b00bdef9005b928aad13e1d679b
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced82544d36b1729153c8aeb179e84750f0c085d3b1Fixedff20d16b2e8230c034e21540043df47222dcc09bFixed8c0c602202b9a4909b00bc3354e3c0355bc69e65
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.6.144Fixed6.6.158
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.12.95Fixed6.12.112
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.18.38Fixed6.18.54
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced7.0.4Fixed7.1
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedcd0e707a927a70cdfd8bc5a512a9719a87f5ed51
Affected versions
v6.*
v7.*
Linux / Kernel
Package
- Name
- Kernel