Skip to main content

Linux Kernel EUVDEUVD-2026-39265

| CVE-2026-53174 HIGH
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-xxjh-4wcx-gmq5
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
3.3 LOW

Local low-priv trigger via nested overlay readdir (AV:L/AC:L/PR:L); described impact is a spurious error return, so no real C/I and only minor availability (A:L), unlike the input's C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:21 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ovl: keep err zero after successful ovl_cache_get()

ovl_iterate_merged() stores PTR_ERR(cache) in err before checking IS_ERR(cache). On success err holds the truncated cache pointer and can be returned as a bogus non-zero error.

The syzbot reproducer reaches this through overlay-on-overlay readdir:

getdents64 iterate_dir(outer overlay file) ovl_iterate_merged() ovl_cache_get() ovl_dir_read_merged() ovl_dir_read() iterate_dir(inner overlay file) ovl_iterate_merged()

Only compute PTR_ERR(cache) on the error path.

AnalysisAI

Improper error handling in the Linux kernel's overlayfs (ovl) directory-iteration code causes ovl_iterate_merged() to return a truncated cache pointer as a bogus non-zero error code after a successful ovl_cache_get(). The flaw is reachable by a local user performing a getdents64/readdir on a stacked overlay-on-overlay mount, as demonstrated by a syzbot reproducer; there is no public exploit and it is not actively exploited. EPSS is very low (0.16%, 6th percentile), consistent with a hard-to-leverage local logic bug rather than a broadly weaponizable flaw.

Technical ContextAI

Overlayfs is the kernel's union filesystem that merges an upper (writable) and lower (read-only) directory into a single namespace, heavily used by container runtimes (Docker/Podman/Kubernetes) and live media. The bug lives in the merged-readdir path: ovl_iterate_merged() unconditionally computed PTR_ERR(cache) into 'err' before testing IS_ERR(cache), so on the success path 'err' held the (truncated) kernel pointer value of the cache object and could be propagated upward as a spurious errno. The trigger is recursive overlay nesting (overlay mounted over another overlay), where the inner overlay's iterate_dir feeds back into ovl_iterate_merged(). CWE is unassigned in the input, but the root cause is an error-handling logic defect - computing/using an error value on a non-error path. The fix moves the PTR_ERR(cache) computation onto the error branch only.

RemediationAI

Upstream fix available (commits e7051909a01bfb883bfa78b27514854068ac4b85 and 1711b6ed6953cee5940ca4c3a6e77f1b3798cee2); per the EUVD data the corrected kernel builds are 7.0.13 and 7.1, so upgrade to a distribution kernel that incorporates these stable commits and reboot. Apply your distribution's patched kernel as the primary remediation rather than building from source where possible. As a compensating control until patched, avoid or restrict nested overlay-on-overlay mounts (the specific trigger) and limit unprivileged users' ability to create overlay mounts - e.g., disable unprivileged user namespaces (sysctl kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0) where your container stack does not require them; note the side effect that this can break rootless containers and some sandboxing. Given the low practical impact, scheduling the fix in normal kernel-patching cycles is reasonable for most environments.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-39265 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy