CVE-2026-89768 - fs: fix user path of nested backing files
Brief
CVE ID : CVE-2026-89768
Published : Sept. 11, 2026, 8:20 p. m.
- 32 minutes ago
Description : In the Linux kernel, the following vulnerability has been resolved:
fs: fix user path of nested backing files
backing_file_open() derives the path to be stored in the new backing file from user_file-f_path. This is incorrect when user_file itself is a backing file, which is the case for nested stacking filesystems, e. g. overlayfs mounts where the lowerdir of one overlayfs is the merged directory of another.
Since commit def3ae83da02 ("fs: store real path instead of fake path in backing file f_path") the f_path of a backing file holds the real path of the intermediate layer, not the path that the user opened.
Commit 924577e4f6ca ("ovl: Fix nested backing file paths") fixed this for such configurations by passing file_user_path() from ovl_open_realfile().