The kernel function vfs_tmpfile() mistakenly allowed a process to create an O_TMPFILE on an idmapped filesystem where its filesystem user or group ID is not mapped. The created temporary inode is initialized with an owner of (uid_t)-1, a value that the filesystem cannot represent. When the file is later linked into the namespace with linkat(2), the resulting file has an unmapped or invalid owner, which can be used by an attacker to fake ownership or bypass security checks that rely on standard ownership semantics.

All Linux kernel releases prior to the inclusion of the missing mapping check in vfs_tmpfile() are affected. This flaw touches every filesystem that supports tmpfile creation through the FS_ALLOW_IDMAP flag, such as tmpfs, ext4, btrfs, xfs, f2fs, and overlayfs, on mounts configured for ID mapping where the current process’s fsuid or fsgid is not covered by the mapping.

The vulnerability is exploitable locally by any user who can create an O_TMPFILE on an idmapped filesystem with an unmapped fsuid or fsgid. An attacker can produce a file whose apparent owner is an unmapped user, potentially allowing them to defeat ownership‑based access controls or manipulate data integrity. No public exploit is known, the EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.5 indicates moderate severity.