Junglewise Threat Intelligence

CVE-2026-89768: Linux kernel backing file path resolution in nested overlay filesystems

CVE-2026-89768 · Severity: info · Published 2026-09-11

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel incorrectly resolves file paths when overlay filesystems are nested on top of each other. This causes applications to see wrong file paths in their memory maps and system tracing output, potentially confusing administrators, debuggers, and performance monitoring tools relying on accurate path information.

Technical details

The vulnerability exists in the backing_file_open() function, which derives the user-visible path from user_file->f_path. When user_file is itself a backing file (as in nested overlayfs configurations), this stores the intermediate layer's real path rather than the outermost user-visible path. A prior fix in commit 924577e4f6ca was silently re-introduced by commit 6af36aeb147a when LSM hooks were added. The impact is that /proc/<pid>/maps and perf/ftrace mmap records display disconnected or incorrect paths for files accessed through nested overlayfs. The fix uses file_user_path() to consistently retrieve the outermost user-visible path for backing files while falling back to &user_file->f_path for regular files. The issue affects overlayfs, FUSE passthrough, and erofs ishare when their user files are themselves backing files.

Affected products

  • Linux Linux kernel commit 6af36aeb147a onwards

Timeline

  • 2026-09-11: disclosed

Related threats