From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 43E9F5947F1 for ; Fri, 11 Sep 2026 20:06:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789157205; cv=none; b=W1cWOzjYUWQD3tztIlCYyNCIzC/2vbvFPHAU7TV62dZvP9L+81NzxHUa1w3PQYTJ2J4/18jJ3oomJv7wOZlfioCga8dekTcb292rsqEeXiWppRpn+PjW3peQVgoPgtyIxTKnoAIBROtyqqlPO2RQlYD4vyYSPLBUxSbPp2xWshk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789157205; c=relaxed/simple; bh=rwQkxjQExRLJG1gN1xBiWGky0hbC+5WL6LBhUQGh56I=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=dsKVZsEAaqZJgPRyLf/kbe9PwMQPJ5Q7bkGm/kE2KsoTiKtoJezi2LXe6jXr8ow/QyV17NdzzqZykSFerhu85pQACdq4JdkpKYYvGOe/xhvoOikeRnOeAghFyD44wM3T8vCz9si94V7f60tKDdMR/DafgcOx6v7I7VUG38nIt0M= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=hIgqGHrq; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="hIgqGHrq" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B44D61F000FF; Fri, 11 Sep 2026 20:06:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789157199; bh=0uJIVRmUTLxnnaqF6bLbWbDuw9odCRCZfqG3LEWw2t4=; h=From:To:Cc:Subject:Date:Reply-To; b=hIgqGHrqGvZMSm9jYUvJw1rsjaZxy178fTMeHEFlS0LegRRtZbD4HNxbWT8eCpxho +RRld3c+mQRpUpEDhZlzMG0Yh9JVcgpke/+62q47/S4wlFY+EBEYJIWGqybjKg5zf0 Pu5ZBi2g5oZJcFmf2901yjJgy1iXdAtXKH8nG5gY= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89768: fs: fix user path of nested backing files Date: Fri, 11 Sep 2026 21:47:37 +0200 Message-ID: <2026091111-CVE-2026-89768-51e4@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4882; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=/BSoiB9BN4hrxuAXmkL89M791DC+gOy33R0SBJMu7aQ=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlLIieXz5v4UPXWtk1xviddvZn2e8+zbHLeFnKIf7m22 X5Vi7BvHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjCR6QUMC/rcZZzL2lbumvTq RoTPsdBvXbuC/zEs2HHn7OzDB8w/L93Y+iLYTlrnlO2OxwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: fs: fix user path of nested backing files backing_file_open() derives the path to be stored in the new backing file from user_file->f_path. This is incorrect when user_file itself is a backing file, which is the case for nested stacking filesystems, e.g. overlayfs mounts where the lowerdir of one overlayfs is the merged directory of another. Since commit def3ae83da02 ("fs: store real path instead of fake path in backing file f_path") the f_path of a backing file holds the real path of the intermediate layer, not the path that the user opened. Commit 924577e4f6ca ("ovl: Fix nested backing file paths") fixed this for such configurations by passing file_user_path() from ovl_open_realfile(). However, commit 6af36aeb147a ("lsm: add backing_file LSM hooks") changed the first argument of backing_file_open() from the user path back to the user file and derived the path from user_file->f_path again, silently re-introducing the problem. As a result, files mapped through a nested overlayfs show the wrong path in /proc//maps and in perf/ftrace mmap records. For example, with two nested overlayfs mounts: mkdir -p /ovl/{lower,upper,work,merged} /ovl/nested echo hello > /ovl/lower/foo mount -t overlay overlay \ -o lowerdir=/ovl/lower,upperdir=/ovl/upper,workdir=/ovl/work \ /ovl/merged # at least two lowerdirs are needed when upperdir is nonexistent mount -t overlay overlay \ -o lowerdir=/ovl/merged:/ovl/lower /ovl/nested mapping /ovl/nested/foo shows a disconnected path instead of the user path: # readlink /proc/self/fd/3 /ovl/nested/foo # grep foo /proc/self/maps 7f6e2c100000-7f6e2c101000 r--s 00000000 00:24 15813027 /foo The bogus path is derived from the f_path of the intermediate backing file, whose mount is a private clone that d_path() cannot resolve. Fix this by using file_user_path(), which returns the outermost user-visible path for backing files and falls back to &user_file->f_path for regular files. This restores the behavior of commit 924577e4f6ca ("ovl: Fix nested backing file paths") for overlayfs and also fixes the same problem for the other backing_file_open() callers, fuse passthrough and erofs ishare, when their user file is itself a backing file. backing_tmpfile_open() has the same pattern but is not affected: it is only called by ovl_create_tmpfile() for the upper layer, and another overlayfs is rejected as upperdir by the DCACHE_OP_REAL check in ovl_mount_dir_check(), so its user_file can never be a backing file. The Linux kernel CVE team has assigned CVE-2026-89768 to this issue. Affected and fixed versions =========================== Issue introduced in 6.12.95 with commit 5b6aa9a843205da92d860e5011a7b29062a76b8f and fixed in 6.12.109 with commit 88c927a63dc717b6d46b20fe13ea713916e49089 Issue introduced in 6.18.38 with commit 5dfcb15974e7d0f96aca278dd9f1b85df91523ef and fixed in 6.18.50 with commit c03114634d342648bd34910aa8fb88007e92cc3c Issue introduced in 7.1 with commit 6af36aeb147a06dea47c49859cd6ca5659aeb987 and fixed in 7.2.4 with commit a35cc21355734e1acb89973d9be90ca8e4c3ed2f Issue introduced in 7.1 with commit 6af36aeb147a06dea47c49859cd6ca5659aeb987 and fixed in 7.3-rc1 with commit f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d Issue introduced in 6.6.144 with commit 41c5b269af8b1f0bffcab7766a793f294ae6764e Issue introduced in 7.0.4 with commit 27e795afba0018b0ea9460dbad4bd706d1ba5ee0 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89768 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/backing-file.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/88c927a63dc717b6d46b20fe13ea713916e49089 https://git.kernel.org/stable/c/c03114634d342648bd34910aa8fb88007e92cc3c https://git.kernel.org/stable/c/a35cc21355734e1acb89973d9be90ca8e4c3ed2f https://git.kernel.org/stable/c/f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d