Executive brief
A vulnerability in the Linux kernel's memory management system could allow local users to bypass certain security checks related to file ownership. This issue occurs when using 'idmapped mounts,' a feature that allows files to appear as if they are owned by different users than they are on disk. While primarily affecting side-channel protections, it could lead to unauthorized information disclosure or unexpected behavior in how the system manages memory for specific files.
Technical details
A vulnerability exists in the Linux kernel's memory management (mm) subsystem where inode ownership checks in mincore() and madvise(MADV_PAGEOUT) are performed against the default 'nop_mnt_idmap' instead of the specific idmap of the mount. This root cause stems from the introduction of idmapped mounts, where the kernel failed to propagate the correct mapping to side-channel protection checks. A local attacker can exploit this to bypass 'owner_or_capable' checks on files within idmapped mounts. While often mitigated by secondary permission checks, it specifically impacts scenarios involving read-only files (e.g., mode 0444) where the owner should have access that is incorrectly denied or granted. The fix introduces 'file_owner_or_capable()' to ensure the correct mount idmap is utilized.
Affected products
- Linux Linux Kernel 5.12 to 6.12.96
Timeline
- 2026-06-25: disclosed: Initial patch submitted by Pedro Falcato
- 2026-07-18: patched: Commits merged into stable branches
- 2026-07-25: advisory: CVE-2026-64294 published
References
- https://git.kernel.org/stable/c/04ba248d02d9eaa3d9077b00a6134caa75fa3e90
- https://git.kernel.org/stable/c/5c942ad7df75925ee166e7f0fb36892d8dde376b
- https://git.kernel.org/stable/c/744b23aa430d52f5c8e4dbff7d71496d6643bed2
- https://git.kernel.org/stable/c/8344bdf0629457e532797b42d9d2bbf2a2900bbf
- https://git.kernel.org/stable/c/e187bc02f8fa4226d62814592cf064ee4557c470