CVE-2026-53174: ovl: keep err zero after successful ovl_cache_get()
In the Linux kernel, the following vulnerability has been resolved:
ovl: keep err zero after successful ovlcacheget()
ovliteratemerged() stores PTRERR(cache) in err before checking ISERR(cache). On success err holds the truncated cache pointer and can be returned as a bogus non-zero error.
The syzbot reproducer reaches this through overlay-on-overlay readdir:
getdents64 iteratedir(outer overlay file) ovliteratemerged() ovlcacheget() ovldirreadmerged() ovldirread() iteratedir(inner overlay file) ovliteratemerged()
Only compute PTRERR(cache) on the error path.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53174?
The severity of CVE-2026-53174 is high, rated at 7.8.
How do I fix CVE-2026-53174?
CVE-2026-53174 can be fixed by applying the available patch.
What systems are affected by CVE-2026-53174?
CVE-2026-53174 affects the Linux kernel.
What is the potential impact of CVE-2026-53174?
CVE-2026-53174 can result in a denial of service due to erroneous non-zero error returns.
When was CVE-2026-53174 published?
CVE-2026-53174 was published on June 25, 2026.