CVE-2026-89768

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs: fix user path of nested backing files

backing_file_open() derives the path to be stored in the new backing

file from user_file->f_path. This is incorrect when user_file itself

is a backing file, which is the case for nested stacking filesystems,

e.g. overlayfs mounts where the lowerdir of one overlayfs is the merged

directory of another. Since commit def3ae83da02 ("fs: store real path

instead of fake path in backing file f_path") the f_path of a backing

file holds the real path of the intermediate layer, not the path that

the user opened.

Commit 924577e4f6ca ("ovl: Fix nested backing file paths") fixed this

for such configurations by passing file_user_path() from

ovl_open_realfile(). However, commit 6af36aeb147a ("lsm: add

backing_file LSM hooks") changed the first argument of

backing_file_open() from the user path back to the user file and

derived the path from user_file->f_path again, silently re-introducin

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References