The Linux kernel overlay filesystem (ovl) had a vulnerability where ovl_iterate_merged() stored PTR_ERR(cache) in the err variable before checking if cache was an error pointer. On successful cache retrieval, err incorrectly held a truncated cache pointer value, which could be returned as a false non-zero error. The issue was reproducible through nested overlay directory reads involving ovl_cache_get() and related functions. The fix ensures PTR_ERR(cache) is only computed on the error path, preventing erroneous error returns.

This vulnerability could cause the kernel overlay filesystem to return incorrect error codes during directory iteration operations involving overlay-on-overlay mounts. While it does not directly indicate a security breach or privilege escalation, the incorrect error handling could potentially disrupt filesystem operations or cause unexpected behavior in applications relying on accurate error reporting from the overlay filesystem.

A fix is available in linux-hwe-edge kernel versions 7.0.0-1008.8 and 7.0.0-28.28.1 and later. Users should upgrade to these or newer versions to resolve the issue. Since this is a kernel-level fix, applying the official kernel updates from the vendor is the recommended remediation.