CVE-2026-89768 - Vulnerability Details

- fs: fix user path of nested backing files

Description

In the Linux kernel, the following vulnerability has been resolved:

fs: fix user path of nested backing files

backing_file_open() derives the path to be stored in the new backing
file from user_file->f_path. This is incorrect when user_file itself
is a backing file, which is the case for nested stacking filesystems,
e.g. overlayfs mounts where the lowerdir of one overlayfs is the merged
directory of another. Since commit def3ae83da02 ("fs: store real path
instead of fake path in backing file f_path") the f_path of a backing
file holds the real path of the intermediate layer, not the path that
the user opened.

Commit 924577e4f6ca ("ovl: Fix nested backing file paths") fixed this
for such configurations by passing file_user_path() from
ovl_open_realfile(). However, commit 6af36aeb147a ("lsm: add
backing_file LSM hooks") changed the first argument of
backing_file_open() from the user path back to the user file and
derived the path from user_file->f_path again, silently re-introducing
the problem.

As a result, files mapped through a nested overlayfs show the wrong
path in /proc/<pid>/maps and in perf/ftrace mmap records. For example,
with two nested overlayfs mounts:

mkdir -p /ovl/{lower,upper,work,merged} /ovl/nested
echo hello > /ovl/lower/foo
mount -t overlay overlay \
-o lowerdir=/ovl/lower,upperdir=/ovl/upper,workdir=/ovl/work \
/ovl/merged
# at least two lowerdirs are needed when upperdir is nonexistent
mount -t overlay overlay \
-o lowerdir=/ovl/merged:/ovl/lower /ovl/nested

mapping /ovl/nested/foo shows a disconnected path instead of the user
path:

# readlink /proc/self/fd/3
/ovl/nested/foo
# grep foo /proc/self/maps
7f6e2c100000-7f6e2c101000 r--s 00000000 00:24 15813027 /foo

The bogus path is derived from the f_path of the intermediate backing
file, whose mount is a private clone that d_path() cannot resolve.

Fix this by using file_user_path(), which returns the outermost
user-visible path for backing files and falls back to
&user_file->f_path for regular files. This restores the behavior of
commit 924577e4f6ca ("ovl: Fix nested backing file paths") for
overlayfs and also fixes the same problem for the other
backing_file_open() callers, fuse passthrough and erofs ishare, when
their user file is itself a backing file.

backing_tmpfile_open() has the same pattern but is not affected: it is
only called by ovl_create_tmpfile() for the upper layer, and another
overlayfs is rejected as upperdir by the DCACHE_OP_REAL check in
ovl_mount_dir_check(), so its user_file can never be a backing file.

Published: 2026-09-11

Score: 2.3 Low

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw lies in backing_file_open() deriving a backing file’s path from the f_path of the user file, which is incorrect when the user file is itself a backing file, such as in nested overlayfs. This causes the kernel to record an impossible, disconnected path in /proc/<pid>/maps and perf/ftrace tables. The weakness is a path‑confusion error (CWE‑41) and does not open avenues for code execution or privilege escalation.

Affected Systems

Affected are Linux kernel systems that implement overlayfs, fuse passthrough, or erofs when nested overlayfs mounts are employed. Kernels that have not incorporated the commit that re‑introduces the issue are vulnerable; the specific version threshold is not stated in the data.

Risk and Exploitability

With a CVSS score of 2.3 and an EPSS below 1 %, the risk is considered low. The vulnerability is not listed in CISA KEV, and exploitation would require local kernel access and is limited to manipulating or observing diagnostic output rather than achieving remote code execution. No known attack vector beyond local observation is documented; it is inferred that the attack vector is local only because kernel path manipulation is confined to the host.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5b6aa9a843205da92d860e5011a7b29062a76b8f`	affected	< 88c927a63dc717b6d46b20fe13ea713916e49089
`5dfcb15974e7d0f96aca278dd9f1b85df91523ef`	affected	< c03114634d342648bd34910aa8fb88007e92cc3c
`6af36aeb147a06dea47c49859cd6ca5659aeb987`	affected	< a35cc21355734e1acb89973d9be90ca8e4c3ed2f
`6af36aeb147a06dea47c49859cd6ca5659aeb987`	affected	< f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d
`41c5b269af8b1f0bffcab7766a793f294ae6764e`	affected	—
`27e795afba0018b0ea9460dbad4bd706d1ba5ee0`	affected	—
`6.12.95`	affected	< 6.12.109
`6.18.38`	affected	< 6.18.50
`6.6.144`	affected	< 6.7
`7.0.4`	affected	< 7.1

Linux

affected

Version	Status	Constraints
`7.1`	affected	—
`0`	unaffected	< 7.1
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5b6aa9a843205da92d860e5011a7b29062a76b8f,88c927a63dc717b6d46b20fe13ea713916e49089)`	affected	code_commit	—
`[5dfcb15974e7d0f96aca278dd9f1b85df91523ef,c03114634d342648bd34910aa8fb88007e92cc3c)`	affected	code_commit	—
`[6af36aeb147a06dea47c49859cd6ca5659aeb987,a35cc21355734e1acb89973d9be90ca8e4c3ed2f)`	affected	code_commit	—
`[6af36aeb147a06dea47c49859cd6ca5659aeb987,f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d)`	affected	code_commit	—
`[41c5b269af8b1f0bffcab7766a793f294ae6764e,*]`	affected	code_commit	—
`[27e795afba0018b0ea9460dbad4bd706d1ba5ee0,*]`	affected	code_commit	—
`[6.12.95,6.12.109)`	affected	semver	—
`[6.18.38,6.18.50)`	affected	semver	—
`[6.6.144,6.7)`	affected	semver	—
`[7.0.4,7.1)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`7.1`	affected	generic	—
`[0,7.1)`	unaffected	generic	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that contains the fix
If an immediate kernel upgrade is not feasible, apply the upstream patch that changes backing_file_open() to use file_user_path(), restoring correct user‑visible paths for nested overlayfs, fuse passthrough, and erofs
As a temporary workaround, avoid nested overlayfs mounts or disable overlayfs stacking until the kernel can be patched

Generated by OpenCVE AI on September 15, 2026 at 19:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00209.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/88c927a63dc717b6d46b20fe13ea713916e49089
https://git.kernel.org/stable/c/a35cc21355734e1acb89973d9be90ca8e4c3ed2f
https://git.kernel.org/stable/c/c03114634d342648bd34910aa8fb88007e92cc3c
https://git.kernel.org/stable/c/f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d
https://nvd.nist.gov/vuln/detail/CVE-2026-89768
https://www.cve.org/CVERecord?id=CVE-2026-89768

History

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-41
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89768 https://www.cve.org/CVERecord?id=CVE-2026-89768
Metrics	threat_severity `None`	cvssV3_1 `{'score': 2.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N'}` threat_severity `Low`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: fs: fix user path of nested backing files backing_file_open() derives the path to be stored in the new backing file from user_file->f_path. This is incorrect when user_file itself is a backing file, which is the case for nested stacking filesystems, e.g. overlayfs mounts where the lowerdir of one overlayfs is the merged directory of another. Since commit def3ae83da02 ("fs: store real path instead of fake path in backing file f_path") the f_path of a backing file holds the real path of the intermediate layer, not the path that the user opened. Commit 924577e4f6ca ("ovl: Fix nested backing file paths") fixed this for such configurations by passing file_user_path() from ovl_open_realfile(). However, commit 6af36aeb147a ("lsm: add backing_file LSM hooks") changed the first argument of backing_file_open() from the user path back to the user file and derived the path from user_file->f_path again, silently re-introducing the problem. As a result, files mapped through a nested overlayfs show the wrong path in /proc/<pid>/maps and in perf/ftrace mmap records. For example, with two nested overlayfs mounts: mkdir -p /ovl/{lower,upper,work,merged} /ovl/nested echo hello > /ovl/lower/foo mount -t overlay overlay \ -o lowerdir=/ovl/lower,upperdir=/ovl/upper,workdir=/ovl/work \ /ovl/merged # at least two lowerdirs are needed when upperdir is nonexistent mount -t overlay overlay \ -o lowerdir=/ovl/merged:/ovl/lower /ovl/nested mapping /ovl/nested/foo shows a disconnected path instead of the user path: # readlink /proc/self/fd/3 /ovl/nested/foo # grep foo /proc/self/maps 7f6e2c100000-7f6e2c101000 r--s 00000000 00:24 15813027 /foo The bogus path is derived from the f_path of the intermediate backing file, whose mount is a private clone that d_path() cannot resolve. Fix this by using file_user_path(), which returns the outermost user-visible path for backing files and falls back to &user_file->f_path for regular files. This restores the behavior of commit 924577e4f6ca ("ovl: Fix nested backing file paths") for overlayfs and also fixes the same problem for the other backing_file_open() callers, fuse passthrough and erofs ishare, when their user file is itself a backing file. backing_tmpfile_open() has the same pattern but is not affected: it is only called by ovl_create_tmpfile() for the upper layer, and another overlayfs is rejected as upperdir by the DCACHE_OP_REAL check in ovl_mount_dir_check(), so its user_file can never be a backing file.
Title		fs: fix user path of nested backing files
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/88c927a63dc717b6d46b20fe13ea713916e49089 https://git.kernel.org/stable/c/a35cc21355734e1acb89973d9be90ca8e4c3ed2f https://git.kernel.org/stable/c/c03114634d342648bd34910aa8fb88007e92cc3c https://git.kernel.org/stable/c/f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:47:08.119Z

Updated: 2026-09-11T19:47:08.119Z

Reserved: 2026-09-11T19:38:34.764Z

Link: CVE-2026-89768

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:20:08.090

Modified: 2026-09-11T20:20:08.090

Link: CVE-2026-89768

Redhat

Severity : Low

Publid Date: 2026-09-11T19:47:08Z

Links: CVE-2026-89768 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T20:00:08Z

Weaknesses

CWE-41
Improper Resolution of Path Equivalence

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object