Executive brief
A bug in the Linux kernel's overlayfs (overlay filesystem) implementation allows files to be copied across different overlay filesystems using the copy_file_range operation while bypassing proper permission checks. An attacker could read files from a source filesystem using the destination's permissions rather than the source's, potentially exposing confidential data or, conversely, being denied legitimate access. This affects systems using overlayfs for container storage, virtual machines, or layered filesystem operations.
Technical details
The vulnerability is an authorization bypass in the overlayfs copy_file_range handler (fs/overlayfs/file.c). When copying files across two different overlay filesystems (cross-superblock copy), the read permission check for the source file was performed using the destination overlay's mounter credentials instead of the source overlay's mounter credentials. This could allow unauthorized read access to the source file if the destination mounter has higher privileges, or deny legitimate cross-overlay copies if the destination mounter has lower privileges. The fix adds an explicit read access verification using the source filesystem's mounter credentials before performing the copy operation when the source and destination inodes reside on different superblocks.
Affected products
- Linux Linux kernel 5.0 and later (overlayfs copy_file_range support added via commit 5dae222a5ff0c)
Timeline
- 2026-08-12: disclosed
- 2026-07-12: patched: Upstream fix by Amir Goldstein (commit a1e0eb8f55cfe09bb31a202a388babc411292656)