CVE-2026-98214: selinux: recheck intermediate backing files on mprotect()
In the Linux kernel, the following vulnerability has been resolved:
selinux: recheck intermediate backing files on mprotect()
mprotect() can be used to bypass the SELinux checks that mmap() performs against the intermediate layers of a stacked filesystem.
mmap() checks every backing layer as the request descends through the stack. mprotect() only has the lowest backing file in vma->vmfile, so it rechecks the top-level user and the lowest mounter, but skips the mounters of every layer in between. With two nested overlayfs mounts and a policy denying mountert -> middlefilet:file { execute }, a direct mmap(PROTEXEC) is denied:
avc: denied { execute } for pid=71 comm="nestedexec" path="/payload" dev="overlay" ino=9 scontext=useru:baser:mountert tcontext=useru:objectr:middlefilet tclass=file permissive=0
while mmap(PROTNONE) followed by mprotect(PROTEXEC) succeeds.
Preserve each intermediate path, mounter SID and file-description SID in the backing-file security blob, copying the saved entries when another backing layer is opened. Allocate the array only for nested backing files, and release it and the path references in the backingfilefree hook.
During mprotect(), recheck fd { use } and the requested inode permissions for every saved mounter, and include the intermediate layers in the execmod checks. Policy for nested stacking may then need to grant intermediate mounters what a direct mmap() already requires, and execmod on intermediate labels for binaries using text relocations.
Tested on arm64 QEMU with a small BusyBox initramfs and a purpose-built SELinux policy, on a mainline tree containing commit f2381b546e7e ("fs: fix user path of nested backing files").
[PM: subject tweak]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Update policy for nested stacking so intermediate mounters receive the permissions that a direct mmap() already requires.
SELinux policy intermediate mounter permissions = Grant intermediate mounters the permissions required by direct mmap() checks - Configuration
For binaries using text relocations, update policy to grant execmod on intermediate labels.
SELinux policy execmod permissions on intermediate labels = Grant execmod on intermediate labels when required
Event History
Frequently Asked Questions
Which deployments are exposed?
Systems using SELinux with two nested overlayfs mounts are exposed when policy denies execute permission from the relevant mounter domain to an intermediate backing-file label. The bypass concerns execution permission checks on intermediate filesystem layers.
What does an attacker need to do to trigger the bypass?
The attacker needs a mapping through the nested stacked filesystem that would be denied if requested with PROT_EXEC directly. They can map it with PROT_NONE and then change the mapping to PROT_EXEC using mprotect(), causing the intermediate-layer checks to be skipped.