From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 50C0037F8C2 for ; Sat, 22 Aug 2026 15:36:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787412999; cv=none; b=OHWqpjGYr7KwHqWet00mHVVhJA2gAQGA68LX6sVAdFb1v50KpvZU2qKyHC7hFOTcuHZIrUysmaNgn6gltkHbuqAyHe2mAq3dvzbXVUYzH7uA+cVNxTRZ7WCB++aA1nz2QN/E6yXOq4JsQcjIjGqoTHW1BADeOpP0xAT8Tmx2Iks= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787412999; c=relaxed/simple; bh=LbO5W+vWFAEFBHkuuIxgp7WsofKR8dnySiPDf3KKErw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=hS8mmidpX1fjgviyCXC0c9GAeaDSq53Om+rgM+iOkMwsprza56LRwdCv/3ppG4KfPGQmpT/iysd0BoY8AayN6Flq3zPadkr+mPX7YpV2aoACXCUNyt67X+l0ZCatoZDU+z2bVcofJM6INIJUa+JMBFBjhwLKx78UlY0IN3lwHfQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=XZYCLdlU; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="XZYCLdlU" Received: by smtp.kernel.org (Postfix) with ESMTPSA id AA78C1F000E9; Sat, 22 Aug 2026 15:36:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1787412998; bh=nly7GARG/Qwdj5VVDKnABe809z4hWv9DFLF2YL48DJk=; h=From:To:Cc:Subject:Date:Reply-To; b=XZYCLdlUn098ibuIxzc833f0+PRyRYoGW3BybinE7W1rr1DiuTIufHWuVekN7feRU L81Y6lNZrrU51xisNTpE50aEYCiLvk+OOq2eOlYFXLM2os81qhsQaFH36iTq0wEPIV c9yp4LFwdTMGUOESvJKFkbtfrKWHHpc1xe5JTPGU= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-74619: ovl: don't warn when the mount is completed from another user namespace Date: Sat, 22 Aug 2026 17:31:43 +0200 Message-ID: <2026082219-CVE-2026-74619-ff9d@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4196; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=Z6QZ8S9zwB3fiFEbV0OwLbI0lMEaCv+4GsMGgRdU3PY=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmdB4532fEXTNxu0nBeP89M7Pb7jb9FL83bzWLb094lH f1M0EygI5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACayupZhftD6k+/vpgWfSzr0 RV2Cb4ZLrOzkBIYFG18enno1MrZq0zvvL2zvWxV/q81rAQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: ovl: don't warn when the mount is completed from another user namespace fsopen() records the caller's user namespace in fc->user_ns and hands back an ordinary file descriptor. Nothing ties the task that calls fsconfig(FSCONFIG_CMD_CREATE) to the task that created the context. The fd is inherited across fork() and exec() and it can be passed over a unix socket. Completing a context from another user namespace is allowed on purpose. vfs_cmd_create() authorizes the create with mount_capable(), which for FS_USERNS_MOUNT checks ns_capable(fc->user_ns, CAP_SYS_ADMIN), and that succeeds for a task holding CAP_SYS_ADMIN in an ancestor of fc->user_ns. So an unprivileged task can reach the WARN_ON() in ovl_fill_super(): create a user and a mount namespace in a child, call fsopen("overlay") there, send the fscontext fd to the parent and let the parent issue FSCONFIG_CMD_CREATE. Both namespaces come from a plain unshare(1) and no capability is needed anywhere: WARNING: fs/overlayfs/super.c:1551 at ovl_fill_super+0x7b9/0x1e20 [overlay] CPU: 3 UID: 1000 PID: 3243376 Comm: fswarn Call Trace: get_tree_nodev+0x71/0xa0 ovl_get_tree+0x15/0x20 [overlay] vfs_get_tree+0x2a/0x100 vfs_cmd_create+0x60/0xf0 __do_sys_fsconfig+0x4b2/0x500 The child needs the mount namespace because fsopen() itself gates on may_mount(), which asks for CAP_SYS_ADMIN in the user namespace owning the caller's mount namespace. fsconfig() doesn't repeat that check. It is a WARN_ON() and not a WARN_ON_ONCE(), so the condition can be raised in a loop to taint the kernel and flood the log, and it panics a kernel booted with panic_on_warn. Keep refusing the mount and stop warning about it. ovl_parse_param() already spells a user namespace check this way for Opt_override_creds. The Linux kernel CVE team has assigned CVE-2026-74619 to this issue. Affected and fixed versions =========================== Issue introduced in 6.5 with commit 1784fbc2ed9c888ea4e895f30a53207ed7ee8208 and fixed in 6.6.152 with commit 513478092966dc9818d96dd2b3ed613fd2f6e30e Issue introduced in 6.5 with commit 1784fbc2ed9c888ea4e895f30a53207ed7ee8208 and fixed in 6.12.104 with commit 494346f2aab2489d379d43ff614aea447cf4e94d Issue introduced in 6.5 with commit 1784fbc2ed9c888ea4e895f30a53207ed7ee8208 and fixed in 6.18.45 with commit be161fa31e3e9cc828a3c1bd935edca461e8a7a1 Issue introduced in 6.5 with commit 1784fbc2ed9c888ea4e895f30a53207ed7ee8208 and fixed in 7.1.9 with commit 42d99fcd8006007e2f708bede6789f37f3910b30 Issue introduced in 6.5 with commit 1784fbc2ed9c888ea4e895f30a53207ed7ee8208 and fixed in 7.2 with commit 63981fc786daaa626cb14d9be1406f674d79f98f Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-74619 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/overlayfs/super.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/513478092966dc9818d96dd2b3ed613fd2f6e30e https://git.kernel.org/stable/c/494346f2aab2489d379d43ff614aea447cf4e94d https://git.kernel.org/stable/c/be161fa31e3e9cc828a3c1bd935edca461e8a7a1 https://git.kernel.org/stable/c/42d99fcd8006007e2f708bede6789f37f3910b30 https://git.kernel.org/stable/c/63981fc786daaa626cb14d9be1406f674d79f98f