The Linux kernel overlay filesystem (ovl) contained a logic flaw in ovl_iterate_merged() where PTR_ERR(cache) was stored in an error variable before checking IS_ERR(cache). On success, this caused the error variable to hold a truncated cache pointer, which could be misinterpreted as a non-zero error. This was reproducible via overlay-on-overlay readdir operations. The issue was fixed by ensuring PTR_ERR(cache) is only computed on the error path. The vulnerability affects multiple Linux kernel versions prior to 7.0.0-28.28 and related builds. The fix is included in updated kernel packages distributed by Ubuntu.

The vulnerability can cause incorrect error reporting in the overlay filesystem, potentially leading to unexpected behavior in file system operations involving overlay-on-overlay directories. The CVSS 3.1 score of 7.8 indicates high impact on confidentiality, integrity, and availability if exploited. However, exploitation requires local access with low privileges and no user interaction. There are no known exploits in the wild. The issue could affect system stability or security in environments using overlay filesystems.

An official patch is available and included in updated Linux kernel packages for Ubuntu 26.04 LTS and related releases. Users should apply the kernel updates and reboot their systems to ensure the vulnerability is remediated. Due to an ABI change, third-party kernel modules must be recompiled and reinstalled after updating. No additional mitigation steps are required beyond applying the official updates.