{"id":33284,"date":"2026-10-06T20:31:41","date_gmt":"2026-10-06T12:31:41","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98215"},"modified":"2026-10-06T20:31:41","modified_gmt":"2026-10-06T12:31:41","slug":"cve-2026-98215","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98215","title":{"rendered":"CVE-2026-98215 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: preserve use"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>selinux: preserve user SID across nested backing files<\/p>\n<p>SELinux saves the user file SID in a backing-file security blob so it<br \/>\nremains available after mmap() replaces vma-&gt;vm_file with a backing file.<\/p>\n<p>For nested backing files (overlayfs over overlayfs, or FUSE passthrough<br \/>\nbacked by overlayfs), user_file may itself be a backing file.  Its<br \/>\nfsec-&gt;sid is the SID of the mounter that opened it, rather than the user<br \/>\nthat opened the top-level file.  mprotect() then checks fd { use } against<br \/>\nthe mounter SID.  This can incorrectly deny access without a domain<br \/>\ntransition, or check the wrong target SID after one.<\/p>\n<p>Copy the saved user SID when user_file is a backing file.  Keep using the<br \/>\nregular file SID for the first backing layer.<\/p>\n<p>With two nested overlayfs mounts and SELinux enforcing,<br \/>\nmprotect(PROT_READ) returns EACCES with an fd { use } denial against the<br \/>\nmounter SID.  With this change, mprotect() succeeds.<\/p>\n<p>Tested on arm64 QEMU with a small BusyBox initramfs and a purpose-built<br \/>\nSELinux policy.  The original test was also repeated with Fedora Cloud<br \/>\nBase 44 userspace and gave the same result.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>selinux: preserve user SID across nested backing files<\/p>\n<p>SELinux saves the user file SID in a backing-file security blob so it<br \/>\nremai<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33284","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33284","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33284"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33284"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33284"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}