SELinux records a user file SID in a backing file security blob so the SID survives an mmap() that swaps the file pointer with a backing file. When two overlay filesystems (or a FUSE passthrough backed by overlay) are stacked, the top‑level file’s backing file can itself be a backing file, causing the stored SID to reference the process that opened that inner backing file, not the original user. During a subsequent mprotect() the kernel compares the file descriptor’s SID with the SID of the mounter, which may incorrectly deny access or, if a domain transition occurs, perform the check against the wrong target SID. Based on the description, it is inferred that this mismatch could allow a user to bypass SELinux policy checks, potentially elevating privileges or accessing files they should not.

All Linux kernel versions that include the SELinux subsystem and support nested overlay filesystems or a FUSE passthrough over overlay are affected. The vulnerability exists in any kernel release prior to the commit that copies the original user SID for nested backing files.

The flaw is an authorization weakness; CVSS score of 7.0 indicates moderate to high severity, while the EPSS score of < 1% suggests a very low exploitation probability. Exploitation requires an attacker to configure nested overlay mounts and trigger an mprotect() on a file intended to be readable. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a local attacker or a user with privileges to create the necessary mount points. Because the conditions are specific and require privileged operations, the risk overall is considered limited, though the possibility of privilege escalation cannot be ruled out.