VulnerabilityPublished 6 Oct 2026Updated 19 Oct 2026

CVE-2026-98215: Linux kernel · selinux: preserve user SID across nested backing files

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in ff20d16b2e8230c034e21540043df47222dcc09b : update Linux kernel when convenient.

Data as of 26 Oct 2026, 13:47 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in ff20d16b2e8230c034e21540043df47222dcc09b, caa1b913d90d5dc07073733326d2af0f0288f089, 9d99b770e7b67b00bdef9005b928aad13e1d679b +6

Exploitation evidence

Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=6.6.144 <6.6.158 >=6.12.95 <6.12.112 >=6.18.38 <6.18.54 >=7.0.4 <7.1	Fixed in ff20d16b2e8230c034e21540043df47222dcc09b caa1b913d90d5dc07073733326d2af0f0288f089 9d99b770e7b67b00bdef9005b928aad13e1d679b 8c0c602202b9a4909b00bc3354e3c0355bc69e65 7.1 6aaeec59aadcd1eafc18b049f1b759fb6b9d9569 6.18.54 6.12.112 6.6.158
LinuxLinux	Affected =7.1	Fixed in–

AI-suggested

This vulnerability has been fixed in Linux kernel versions 6.6.158, 6.12.112, 6.18.54, 7.1, and later. Users should upgrade to these or later versions to resolve the issue. No additional mitigation is required once the system is updated.

Description

A vulnerability in the Linux kernel's SELinux implementation involving nested backing files in overlayfs or FUSE passthrough overlays could cause incorrect access denials during mprotect() calls. The issue arises because the user security identifier (SID) is not preserved correctly across nested backing files, leading to permission checks against the wrong SID. This has been fixed in specific Linux kernel versions.

Impact

Without the fix, SELinux enforcing mode on Linux kernels with nested backing files can cause mprotect() calls to fail with EACCES due to permission checks against an incorrect SID. This results in unintended access denials, potentially disrupting applications relying on memory protection changes. The issue does not appear to allow privilege escalation or bypass but causes incorrect access denials.

Summary

The Linux kernel SELinux subsystem saves the user file SID in a backing-file security blob to maintain correct access control after mmap() replaces the virtual memory area's file with a backing file. However, when nested backing files are used (such as overlayfs over overlayfs or FUSE passthrough backed by overlayfs), the user_file may itself be a backing file. In this case, the stored SID corresponds to the mounter rather than the user who opened the top-level file. Consequently, mprotect() checks permissions against the mounter SID, which can incorrectly deny access or check the wrong target SID after a domain transition. The patch copies the saved user SID when the user_file is a backing file, preserving correct permission checks. This fix resolves mprotect(PROT_READ) returning EACCES errors under SELinux enforcing mode with nested overlayfs mounts. The fix has been tested on arm64 QEMU and Fedora Cloud Base 44 userspace.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 12:10 UTC

Technical details

References

Community reviews

Related threats