From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 78BEE22A4EE for ; Tue, 6 Oct 2026 08:48:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791276483; cv=none; b=Xn6ZoGiMild1LlKmL8tjpAAbQTYkV8UcZSMJ39Y7WPduNy6R2/S/ESpbLAcm2WsBQ6v6GdIJcbwIBlJQpvRUBND7JOO7ilgzLDsJ/1cs8N9OiYdWEU/uyfy+MLLXgGlAq0XFvKXxAZHeXJAPaRnRJBiC/9Hkc5I+ctHVexQpcq4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791276483; c=relaxed/simple; bh=l75PBviiFSkwo7yEQVb6mUGMGwqqplsSSUPNgRxYxs0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=HsmbZELZ0cOVIFc1YMbUMAhHCGSG73VMeCimDFhzDbuo0f1Tcw9HqwNmmP3Rt8ZMf3yqjuAdV56kDfnQbcmJpCr5fgKp2trtO0rRgt/LMgTTf92qsH+A6yHQ+JQcw5jKhqnUUu6aDoIQMZOlp1xP7+jCoOsxbDEVrTdrHWlTuXM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Bxzzxsw6; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Bxzzxsw6" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 80FBA1F000FF; Tue, 6 Oct 2026 08:48:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1791276482; bh=hUI8GynpjWBtHxeZoEIz2sBgBGrMv2ZaZ+J1zUE+3q8=; h=From:To:Cc:Subject:Date:Reply-To; b=Bxzzxsw6m/aJjRhVi5cOqtpwtnu/NtNxmDzSdEeRUm8nORNF5aOelvP8Npd1/dYPu W3FiDQ9QMLly8K8lpSxbp2X69uA+rOvKyTCk/61abc93nYMgh+L4ivkM18S3kAsonq E5gQkqo9+0QDc4oikvjV81k0LFnl0sJGvq6nDymo= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98214: selinux: recheck intermediate backing files on mprotect() Date: Tue, 6 Oct 2026 10:45:15 +0200 Message-ID: <2026100640-CVE-2026-98214-cedd@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4235; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=SpIS3WzkbsthU55bcEiB9oRrBjrrCFMLB8uU1uHeiGQ=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlHtvyYf13j4qsrMevMbvTv5GX74fn1mE/P7o7shm7ev QEZxxbod8SyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBEHA8yLDhiP4H7u/8D/YIX y7PiZt30MeBWe8mwYOn1nn6lluYWW6fX6Qv52leeCD7YBwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: selinux: recheck intermediate backing files on mprotect() mprotect() can be used to bypass the SELinux checks that mmap() performs against the intermediate layers of a stacked filesystem. mmap() checks every backing layer as the request descends through the stack. mprotect() only has the lowest backing file in vma->vm_file, so it rechecks the top-level user and the lowest mounter, but skips the mounters of every layer in between. With two nested overlayfs mounts and a policy denying mounter_t -> middle_file_t:file { execute }, a direct mmap(PROT_EXEC) is denied: avc: denied { execute } for pid=71 comm="nested_exec" path="/payload" dev="overlay" ino=9 scontext=user_u:base_r:mounter_t tcontext=user_u:object_r:middle_file_t tclass=file permissive=0 while mmap(PROT_NONE) followed by mprotect(PROT_EXEC) succeeds. Preserve each intermediate path, mounter SID and file-description SID in the backing-file security blob, copying the saved entries when another backing layer is opened. Allocate the array only for nested backing files, and release it and the path references in the backing_file_free hook. During mprotect(), recheck fd { use } and the requested inode permissions for every saved mounter, and include the intermediate layers in the execmod checks. Policy for nested stacking may then need to grant intermediate mounters what a direct mmap() already requires, and execmod on intermediate labels for binaries using text relocations. Tested on arm64 QEMU with a small BusyBox initramfs and a purpose-built SELinux policy, on a mainline tree containing commit f2381b546e7e ("fs: fix user path of nested backing files"). [PM: subject tweak] The Linux kernel CVE team has assigned CVE-2026-98214 to this issue. Affected and fixed versions =========================== Issue introduced in 6.6.144 with commit bc6c380c1159de52a252ed11f19a42c47f60a735 and fixed in 6.6.158 with commit 4d50ebe5a27724e020747ffd61a051dec67cb8ec Issue introduced in 6.12.95 with commit 8bacd09f12c27710228562e4d13163e58c5f4a45 and fixed in 6.12.112 with commit 89376fbfdcc1a728e1775f98752cdd90b0930a00 Issue introduced in 6.18.38 with commit d844702198395d3f80222777030f69db6be6b709 and fixed in 6.18.54 with commit d127c7e1f3e1231d8ac8b2738e3f00bea12afe74 Issue introduced in 7.1 with commit 82544d36b1729153c8aeb179e84750f0c085d3b1 and fixed in 7.2.8 with commit c2bbb905af2293549651b614a52ad91e0b462b60 Issue introduced in 7.1 with commit 82544d36b1729153c8aeb179e84750f0c085d3b1 and fixed in 7.3-rc4 with commit 78fc54b934bfb2c18aad8154c7302067146946f9 Issue introduced in 7.0.4 with commit cd0e707a927a70cdfd8bc5a512a9719a87f5ed51 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98214 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: security/selinux/hooks.c security/selinux/include/objsec.h Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/4d50ebe5a27724e020747ffd61a051dec67cb8ec https://git.kernel.org/stable/c/89376fbfdcc1a728e1775f98752cdd90b0930a00 https://git.kernel.org/stable/c/d127c7e1f3e1231d8ac8b2738e3f00bea12afe74 https://git.kernel.org/stable/c/c2bbb905af2293549651b614a52ad91e0b462b60 https://git.kernel.org/stable/c/78fc54b934bfb2c18aad8154c7302067146946f9