The vulnerability lies in the Linux kernel’s overlayfs implementation of copy_file_range. When copying a file across two different overlayfs instances, the kernel performs the read permission check for the source file using the destination overlay’s mounter credentials instead of the source’s. This inconsistency reveals a flaw in privilege management (CWE-266). If the destination overlay is mounted by a user with sufficient rights, that user could read data from the source file that would normally be denied, resulting in an unintended disclosure of sensitive file contents. In some cases the flaw may also cause a denial of a copy that would normally succeed, but this does not pose a separate security threat.

Linux kernel builds that include overlayfs and have not incorporated the fix committed in 5dae222a5ff0c are affected. The issue applies to any kernel version where overlayfs supports cross‑filesystem copy between two distinct overlayfs instances. No specific version range is listed, so any kernel prior to the inclusion of the patch may be vulnerable.

The CVSS score of 7.0 indicates a moderately high risk severity. The EPSS score of less than 1% suggests a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalogue. The flaw is likely exploitable by a local user who can mount or access an overlayfs instance that serves as the destination; such a user could trigger copy_file_range and read protected data. The risk remains moderate, but active exploitation is expected to be uncommon.