A flaw in the Linux kernel’s handling of mprotect() allows a user to bypass the SELinux checks that normally occur during mmap() when files are layered through nested overlay filesystems. The kernel only verifies the top and bottom layers during protection changes, skipping the intermediate mounters, which lets an attacker execute code that would otherwise be denied by policy. The result is unauthorized execution of user‑supplied code, effectively granting elevated privileges on the affected system.

This issue impacts any Linux kernel running nested overlayfs, regardless of vendor or distribution, that has not yet incorporated commit f2381b546e7e and the subsequent fix. All configurations that use multiple overlay mounts on the same file path are potentially vulnerable.

The EPSS score is under 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating a low probability of exploitation. However, the CVSS score of 7.0 indicates a high severity that could lead to privilege escalation if SELinux enforcement fails. The attack vector is local; a user or process can map a file through nested overlays and then change its protection to executable to bypass policy. Administrators should consider the vulnerability a serious local escalation risk even though actual exploitation remains unlikely.