Executive brief
A security flaw was identified in the Linux kernel's SELinux module when handling OverlayFS, a common filesystem used in container environments. The system failed to properly check permissions when a program tried to map or modify memory associated with files in these filesystems. This could allow a user to bypass intended security restrictions and access or execute files they should not have permission to reach.
Technical details
A vulnerability in the SELinux subsystem of the Linux kernel stems from improper access control enforcement on OverlayFS. The SELinux security model for OverlayFS requires that a task has access to the top-level 'user' file and that the mounter's credentials permit access to the underlying 'backing' file. However, the implementation failed to validate these dual requirements during mmap() and mprotect() system calls. An attacker with local access could potentially exploit this to bypass SELinux policy restrictions. The fix introduces the security_mmap_backing_file() LSM hook and utilizes the backing file API to ensure both the user-facing and underlying files are correctly validated against the security policy.
Affected products
- Linux Linux Kernel All versions prior to the fix in May 2026
Timeline
- 2026-05-27: advisory: CVE-2026-46054 published by NVD
- 2026-05-07: patched: Fix committed to the Linux stable tree by Greg Kroah-Hartman