CVE-2026-98215

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

selinux: preserve user SID across nested backing files

SELinux saves the user file SID in a backing-file security blob so it

remains available after mmap() replaces vma->vm_file with a backing file.

For nested backing files (overlayfs over overlayfs, or FUSE passthrough

backed by overlayfs), user_file may itself be a backing file. Its

fsec->sid is the SID of the mounter that opened it, rather than the user

that opened the top-level file. mprotect() then checks fd { use } against

the mounter SID. This can incorrectly deny access without a domain

transition, or check the wrong target SID after one.

Copy the saved user SID when user_file is a backing file. Keep using the

regular file SID for the first backing layer.

With two nested overlayfs mounts and SELinux enforcing,

mprotect(PROT_READ) returns EACCES with an fd { use } denial against the

mounter SID. With this change, mprotect() succeeds.

Tested on arm64 Q

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References