Executive brief
A bug in the Linux kernel's OverlayFS component could cause directory reading operations to fail unexpectedly. When a program tries to list files in a directory that uses multiple layers, the system might incorrectly report an error even when the operation was successful. This primarily affects system stability and the reliability of applications relying on complex file system layouts, such as container environments.
Technical details
A logic error exists in the ovl_iterate_merged() function within fs/overlayfs/readdir.c. The function incorrectly stores the result of PTR_ERR(cache) into an error variable before verifying if the cache pointer is actually an error using IS_ERR(). On successful execution, the error variable retains a truncated pointer value which is then returned as a bogus non-zero error code to the caller. This is specifically triggered during nested overlay-on-overlay readdir operations (e.g., via getdents64). The fix ensures PTR_ERR is only evaluated on the explicit error path and that the function returns zero on success.
Affected products
- Linux Linux Kernel 6.19, 7.0.13, 7.1
Timeline
- 2026-05-14: disclosed: Initial patch submitted by Nirmoy Das
- 2026-06-25: advisory: CVE-2026-53174 published