In earlier Linux kernel releases the kernel function fscrypt_ioctl_set_policy() performed an owner check using the &nop_mnt_idmap map instead of the idmap of the filesystem mount on which the ioctl was issued. This caused comparison of the caller's fsuid with an unmapped on-disk owner. As a result, a legitimate file owner could be denied permission while an unrelated user could be granted the right to set an encryption policy on the file. The flaw allows an attacker to mount a filesystem with idmapping enabled, invoke the ioctl, and change the encryption policy on files they do not own, thereby escalating privileges and potentially tampering with data confidentiality and integrity.

Affected systems include the Linux kernel in any distribution that uses fscrypt on filesystems supporting idmapped mounts such as ext4 and f2fs. Any user who can execute the fscrypt ioctl on such mounts and has the ability to create or modify encrypted files may be impacted.

The vulnerability requires the attacker have access to invoke the fscrypt ioctl on a mounted filesystem that has encryption enabled and idmapping. No publicly available exploits are known and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation would allow privilege escalation within the scope of the filesystem, affecting integrity and confidentiality of encrypted data. The lack of an EPSS score and KEV listing suggests exploitation probability is uncertain, though the symmetry of the flaw makes it potentially exploitable in environments lacking proper access controls.