Executive brief
The Linux kernel's overlayfs (overlay filesystem) contains a flaw that allows an unprivileged user to trigger warning messages and potentially crash systems with panic-on-warn enabled. An attacker can repeatedly trigger the condition across user namespaces to flood kernel logs and destabilize system stability.
Technical details
The vulnerability is a warning condition (WARN_ON) in ovl_fill_super() that can be triggered from an unprivileged user namespace. The issue occurs because fsopen() records the caller's user namespace and allows completing the mount context from a different user namespace via fsconfig(FSCONFIG_CMD_CREATE), which is authorized through mount_capable() checks tied to the recorded namespace. An unprivileged task can exploit this by creating child user and mount namespaces, calling fsopen("overlay") in the child, passing the fscontext fd to the parent, and issuing FSCONFIG_CMD_CREATE from the parent. Since WARN_ON() is not rate-limited, the condition can be triggered repeatedly to taint the kernel log and trigger panics on systems with panic_on_warn enabled.
Affected products
- Linux Linux kernel prior to fix
Timeline
- 2026-08-22: disclosed