CVE-2026-98215

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98215", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.326Z", "datePublished": "2026-10-06T08:44:51.412Z", "dateUpdated": "2026-10-19T09:15:46.038Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:15:46.038Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: preserve user SID across nested backing files\n\nSELinux saves the user file SID in a backing-file security blob so it\nremains available after mmap() replaces vma->vm_file with a backing file.\n\nFor nested backing files (overlayfs over overlayfs, or FUSE passthrough\nbacked by overlayfs), user_file may itself be a backing file. Its\nfsec->sid is the SID of the mounter that opened it, rather than the user\nthat opened the top-level file. mprotect() then checks fd { use } against\nthe mounter SID. This can incorrectly deny access without a domain\ntransition, or check the wrong target SID after one.\n\nCopy the saved user SID when user_file is a backing file. Keep using the\nregular file SID for the first backing layer.\n\nWith two nested overlayfs mounts and SELinux enforcing,\nmprotect(PROT_READ) returns EACCES with an fd { use } denial against the\nmounter SID. With this change, mprotect() succeeds.\n\nTested on arm64 QEMU with a small BusyBox initramfs and a purpose-built\nSELinux policy. The original test was also repeated with Fedora Cloud\nBase 44 userspace and gave the same result."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["security/selinux/hooks.c", "security/selinux/include/objsec.h"], "versions": [{"version": "bc6c380c1159de52a252ed11f19a42c47f60a735", "lessThan": "caa1b913d90d5dc07073733326d2af0f0288f089", "status": "affected", "versionType": "git"}, {"version": "8bacd09f12c27710228562e4d13163e58c5f4a45", "lessThan": "6aaeec59aadcd1eafc18b049f1b759fb6b9d9569", "status": "affected", "versionType": "git"}, {"version": "d844702198395d3f80222777030f69db6be6b709", "lessThan": "9d99b770e7b67b00bdef9005b928aad13e1d679b", "status": "affected", "versionType": "git"}, {"version": "82544d36b1729153c8aeb179e84750f0c085d3b1", "lessThan": "ff20d16b2e8230c034e21540043df47222dcc09b", "status": "affected", "versionType": "git"}, {"version": "82544d36b1729153c8aeb179e84750f0c085d3b1", "lessThan": "8c0c602202b9a4909b00bc3354e3c0355bc69e65", "status": "affected", "versionType": "git"}, {"version": "cd0e707a927a70cdfd8bc5a512a9719a87f5ed51", "status": "affected", "versionType": "git"}, {"version": "6.6.144", "lessThan": "6.6.158", "status": "affected", "versionType": "semver"}, {"version": "6.12.95", "lessThan": "6.12.112", "status": "affected", "versionType": "semver"}, {"version": "6.18.38", "lessThan": "6.18.54", "status": "affected", "versionType": "semver"}, {"version": "7.0.4", "lessThan": "7.1", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["security/selinux/hooks.c", "security/selinux/include/objsec.h"], "versions": [{"version": "7.1", "status": "affected"}, {"version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.144", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.95", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.38", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.4"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/caa1b913d90d5dc07073733326d2af0f0288f089"}, {"url": "https://git.kernel.org/stable/c/6aaeec59aadcd1eafc18b049f1b759fb6b9d9569"}, {"url": "https://git.kernel.org/stable/c/9d99b770e7b67b00bdef9005b928aad13e1d679b"}, {"url": "https://git.kernel.org/stable/c/ff20d16b2e8230c034e21540043df47222dcc09b"}, {"url": "https://git.kernel.org/stable/c/8c0c602202b9a4909b00bc3354e3c0355bc69e65"}], "title": "selinux: preserve user SID across nested backing files", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["security/selinux/hooks.c", "security/selinux/include/objsec.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "caa1b913d90d5dc07073733326d2af0f0288f089", "status": "affected", "version": "bc6c380c1159de52a252ed11f19a42c47f60a735", "versionType": "git"}, {"lessThan": "6aaeec59aadcd1eafc18b049f1b759fb6b9d9569", "status": "affected", "version": "8bacd09f12c27710228562e4d13163e58c5f4a45", "versionType": "git"}, {"lessThan": "9d99b770e7b67b00bdef9005b928aad13e1d679b", "status": "affected", "version": "d844702198395d3f80222777030f69db6be6b709", "versionType": "git"}, {"lessThan": "ff20d16b2e8230c034e21540043df47222dcc09b", "status": "affected", "version": "82544d36b1729153c8aeb179e84750f0c085d3b1", "versionType": "git"}, {"lessThan": "8c0c602202b9a4909b00bc3354e3c0355bc69e65", "status": "affected", "version": "82544d36b1729153c8aeb179e84750f0c085d3b1", "versionType": "git"}, {"status": "affected", "version": "cd0e707a927a70cdfd8bc5a512a9719a87f5ed51", "versionType": "git"}, {"lessThan": "6.6.158", "status": "affected", "version": "6.6.144", "versionType": "semver"}, {"lessThan": "6.12.112", "status": "affected", "version": "6.12.95", "versionType": "semver"}, {"lessThan": "6.18.54", "status": "affected", "version": "6.18.38", "versionType": "semver"}, {"lessThan": "7.1", "status": "affected", "version": "7.0.4", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["security/selinux/hooks.c", "security/selinux/include/objsec.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"lessThan": "7.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: preserve user SID across nested backing files\n\nSELinux saves the user file SID in a backing-file security blob so it\nremains available after mmap() replaces vma->vm_file with a backing file.\n\nFor nested backing files (overlayfs over overlayfs, or FUSE passthrough\nbacked by overlayfs), user_file may itself be a backing file. Its\nfsec->sid is the SID of the mounter that opened it, rather than the user\nthat opened the top-level file. mprotect() then checks fd { use } against\nthe mounter SID. This can incorrectly deny access without a domain\ntransition, or check the wrong target SID after one.\n\nCopy the saved user SID when user_file is a backing file. Keep using the\nregular file SID for the first backing layer.\n\nWith two nested overlayfs mounts and SELinux enforcing,\nmprotect(PROT_READ) returns EACCES with an fd { use } denial against the\nmounter SID. With this change, mprotect() succeeds.\n\nTested on arm64 QEMU with a small BusyBox initramfs and a purpose-built\nSELinux policy. The original test was also repeated with Fedora Cloud\nBase 44 userspace and gave the same result."}], "id": "CVE-2026-98215", "lastModified": "2026-10-19T10:18:22.230", "metrics": {}, "published": "2026-10-06T09:18:08.107", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6aaeec59aadcd1eafc18b049f1b759fb6b9d9569"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8c0c602202b9a4909b00bc3354e3c0355bc69e65"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9d99b770e7b67b00bdef9005b928aad13e1d679b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/caa1b913d90d5dc07073733326d2af0f0288f089"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ff20d16b2e8230c034e21540043df47222dcc09b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: selinux: preserve user SID across nested backing files", "id": "2546336", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546336"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-281", "details": ["A flaw was found in the Linux kernel. When nested storage layers such as layered overlay filesystems are used, the SELinux subsystem fails to preserve the original user Security Identifier (SID, an identifier representing security permissions) across backing files. A local user could trigger this flaw during memory protection operations, causing permission checks to evaluate against an incorrect security context and potentially leading to unauthorized access or improper access denials."], "name": "CVE-2026-98215", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98215\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98215\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98215.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bc6c380c1159de52a252ed11f19a42c47f60a735,caa1b913d90d5dc07073733326d2af0f0288f089)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8bacd09f12c27710228562e4d13163e58c5f4a45,6aaeec59aadcd1eafc18b049f1b759fb6b9d9569)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d844702198395d3f80222777030f69db6be6b709,9d99b770e7b67b00bdef9005b928aad13e1d679b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82544d36b1729153c8aeb179e84750f0c085d3b1,ff20d16b2e8230c034e21540043df47222dcc09b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82544d36b1729153c8aeb179e84750f0c085d3b1,8c0c602202b9a4909b00bc3354e3c0355bc69e65)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cd0e707a927a70cdfd8bc5a512a9719a87f5ed51,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.144,6.6.158)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.95,6.12.112)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.38,6.18.54)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0.4,7.1)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7.1,7.1]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.158,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.112,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.54,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.8,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T14:45:17.733082+00:00", "updated": "2026-10-09T17:15:09.562494+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}