CVE-2026-68448: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-68448 is an authorization bypass vulnerability in the Linux kernel's overlayfs (ovl) implementation affecting the copy_file_range() operation. When copying files between two different overlayfs filesystems, the read permission access hook for the source file is incorrectly invoked using the destination overlayfs mounter's credentials instead of the source overlayfs mounter's credentials. This flaw was introduced with commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices") and affects Linux kernel versions from 5.3 up to (but not including) the fixed commits in stable branches 6.18.42 and 7.1.6. The CVSS estimate is Medium severity with an EPSS score of 0.0 (GitHub Advisory, ENISA EUVD).

The root cause is improper credential handling (authorization bypass, CWE not formally assigned) in the overlayfs copy_file_range() file operation. When a cross-superblock copy is performed between two overlayfs mounts backed by the same underlying filesystem type, the kernel performs the actual file copy using the destination overlayfs mounter's credentials for both source and destination access checks. The read permission hook for the source file should instead use the source overlayfs mounter's credentials. This means a local user can trigger copy_file_range() across two overlayfs mounts, causing the kernel to evaluate source file read access with the (potentially more privileged) destination mount's credentials, bypassing the intended access control on the source. The fix explicitly calls the read access verification for the source file using the source overlayfs mounter's credentials before proceeding with the copy (GitHub Advisory, ENISA EUVD).

A local user with the ability to invoke copy_file_range() across two different overlayfs filesystem mounts can read files from the source overlayfs mount for which they would otherwise lack read permissions, by leveraging the destination mount's mounter credentials. This constitutes an unauthorized information disclosure (confidentiality impact), allowing access to sensitive files that should be protected by the source overlayfs mount's access controls. There is no direct integrity or availability impact, and exploitation is limited to local users on systems where multiple overlayfs mounts are present (GitHub Advisory, ENISA EUVD).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability requires local access to a system with multiple overlayfs mounts and the ability to call copy_file_range() across them. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, ENISA EUVD).

Patches are available in Linux kernel stable branches: version 6.18.42 (commit 9ec22c8113d8cf72ed7197bb61037dcad09e50d8 or 1f4a107439d2e43db176e34919933e617cb7f2c5) and version 7.1.6 (commit a1e0eb8f55cfe09bb31a202a388babc411292656), as well as in 7.2-rc5. Administrators should update to a patched kernel version as the primary remediation. As a workaround until patching is possible, restrict or prohibit the use of copy_file_range() across different overlayfs filesystem mounts on affected systems (GitHub Advisory, ENISA EUVD).