Executive brief
The Linux kernel's debugfs filesystem integrity check was incomplete after a relayfs update, allowing debugfs to remain accessible in lockdown/integrity mode when kernel mmap operations had not been fully migrated to a new API. This could permit unauthorized access to kernel debugging interfaces on systems configured for strict security lockdown.
Technical details
A logic error in the debugfs_locked_down() function failed to check for the newer mmap_prepare file operation alongside the legacy mmap operation. When commit 651fdda8406d converted relayfs to use mmap_prepare, the lockdown security check in fs/debugfs/file.c was not correspondingly updated. This meant files implementing only mmap_prepare (and not mmap) would bypass the lockdown check and remain accessible even when the kernel was in LOCKDOWN_DEBUGFS integrity mode. The fix adds a check for both mmap and mmap_prepare operations to ensure comprehensive coverage during the gradual kernel-wide conversion to the new mmap API. No authentication or user interaction is required; the vulnerability exists in the kernel's security policy enforcement itself.
Affected products
- Linux Linux kernel multiple versions from 2.6.11 through 6.x and later
Timeline
- 2026-09-11: disclosed
- 2026-06-28: patched: fix committed upstream; backported to stable trees by 2026-09-07