Executive brief
The Linux kernel incorrectly resolves file paths when overlay filesystems are nested on top of each other. This causes applications to see wrong file paths in their memory maps and system tracing output, potentially confusing administrators, debuggers, and performance monitoring tools relying on accurate path information.
Technical details
The vulnerability exists in the backing_file_open() function, which derives the user-visible path from user_file->f_path. When user_file is itself a backing file (as in nested overlayfs configurations), this stores the intermediate layer's real path rather than the outermost user-visible path. A prior fix in commit 924577e4f6ca was silently re-introduced by commit 6af36aeb147a when LSM hooks were added. The impact is that /proc/<pid>/maps and perf/ftrace mmap records display disconnected or incorrect paths for files accessed through nested overlayfs. The fix uses file_user_path() to consistently retrieve the outermost user-visible path for backing files while falling back to &user_file->f_path for regular files. The issue affects overlayfs, FUSE passthrough, and erofs ishare when their user files are themselves backing files.
Affected products
- Linux Linux kernel commit 6af36aeb147a onwards
Timeline
- 2026-09-11: disclosed