SUSE-SU-2026:24519-1: Security update for fuse-overlayfs

Q: What workloads are affected by this issue?

The issue affects builds that use fuse-overlayfs and perform chmod on a hardlinked file originating from a lower layer. In that situation, the intended permission change can be silently omitted from the resulting image.

Q: How can I determine whether an existing built image may be affected?

Review build steps that use fuse-overlayfs for chmod operations on files that are hardlinked in lower layers. Verify the resulting image’s file modes, because the permission change may not have been applied even though the build completed.

Q: What is the impact if the issue occurs?

The built image can retain permissions from the lower-layer file rather than the permissions requested by chmod. This can cause the image to have unexpected file access permissions.

Published Nov 2, 2026

Updated

This update for fuse-overlayfs fixes the following issue:

- CVE-2026-77478: chmod on a hardlinked lower-layer file is silently dropped in the built image (bsc#1286378).

Other sources

This update for fuse-overlayfs fixes the following issue: CVE-2026-77478: chmod on a hardlinked lower-layer file is silently dropped in the built image (bsc#1286378).

— SUSE

Affected Software

5 affected componentsFixes available

suse/fuse-overlayfs<1.15-160000.4.1

1.15-160000.4.1

All of the following

SUSE SUSE Linux Micro 6.2 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/fuse-overlayfs<1.15-160000.4.1

1.15-160000.4.1

suse/fuse-overlayfs-debuginfo<1.15-160000.4.1

1.15-160000.4.1

suse/fuse-overlayfs-debugsource<1.15-160000.4.1

1.15-160000.4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/fuse-overlayfs to a version that resolves this vulnerability.
Fixed in 1.15-160000.4.1
Upgrade
Upgrade suse/fuse-overlayfs-debuginfo to a version that resolves this vulnerability.
Fixed in 1.15-160000.4.1
Upgrade
Upgrade suse/fuse-overlayfs-debugsource to a version that resolves this vulnerability.
Fixed in 1.15-160000.4.1
Upgrade
Upgrade fuse-overlayfs to a version that resolves this vulnerability.
Patch SUSE-SL-Micro-6.2-2011

Event History

Nov 2, 2026

Advisory Published

via SUSE·08:37 AM

Data Sourced

via SUSE·08:37 AM

RemedyDescriptionSeverityAffected Software

Advisory Published

via OSV·08:37 AM

Data Sourced

via OSV·08:37 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-77478

Frequently Asked Questions

What workloads are affected by this issue?

The issue affects builds that use fuse-overlayfs and perform chmod on a hardlinked file originating from a lower layer. In that situation, the intended permission change can be silently omitted from the resulting image.

How can I determine whether an existing built image may be affected?

Review build steps that use fuse-overlayfs for chmod operations on files that are hardlinked in lower layers. Verify the resulting image’s file modes, because the permission change may not have been applied even though the build completed.

What is the impact if the issue occurs?

The built image can retain permissions from the lower-layer file rather than the permissions requested by chmod. This can cause the image to have unexpected file access permissions.

SUSE-SU-2026:24519-1: Security update for fuse-overlayfs

Other sources

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What workloads are affected by this issue?

How can I determine whether an existing built image may be affected?

What is the impact if the issue occurs?

Company

Resources

Contact

Frequently Asked Questions

What workloads are affected by this issue?

How can I determine whether an existing built image may be affected?

What is the impact if the issue occurs?