CVE-2026-89768: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-89768 is an information disclosure vulnerability in the Linux kernel caused by incorrect path derivation in nested overlayfs (stacking filesystem) configurations. The flaw resides in the backing_file_open() function, which incorrectly uses user_file->f_path to derive the stored path for backing files when the user file is itself a backing file — a regression silently re-introduced by commit 6af36aeb147a ("lsm: add backing_file LSM hooks"). Affected kernel versions include the 6.6.x series before 6.7, 6.12.x from 6.12.95 to before 6.12.109, 6.18.x from 6.18.38 to before 6.18.50, and 7.0.x from 7.0.4 to before 7.1. The vulnerability was published on September 11, 2026, and carries a Feedly-estimated severity of Medium with an EPSS score of approximately 0.186% (Red Hat CVE, Red Hat Bugzilla, Github Advisory).

The root cause is classified as CWE-41 (Improper Resolution of Path Equivalence). When backing_file_open() is called with a user_file that is itself a backing file (as occurs in nested overlayfs — e.g., an overlayfs whose lowerdir is the merged directory of another overlayfs), the function incorrectly reads user_file->f_path, which holds the real path of the intermediate layer rather than the user-visible path. This was previously fixed by commit 924577e4f6ca ("ovl: Fix nested backing file paths") via file_user_path(), but commit 6af36aeb147a reverted the argument type back to the user file, silently reintroducing the bug. As a result, files mapped through nested overlayfs display a disconnected or bogus path (e.g., /foo instead of /ovl/nested/foo) in /proc/<pid>/maps and in perf/ftrace mmap records. The fix is to use file_user_path(), which returns the outermost user-visible path for backing files and falls back to &user_file->f_path for regular files; the same issue also affects fuse passthrough and erofs ishare callers (Red Hat Bugzilla, Github Advisory).

Any local user with access to a nested overlayfs filesystem can observe incorrect file path information in /proc/<pid>/maps and in performance/trace records (perf/ftrace mmap events), potentially leaking information about the underlying filesystem structure — including intermediate mount paths — that should not be visible to unprivileged users. The impact is limited to confidentiality (information disclosure); there is no known integrity or availability impact, and the vulnerability does not enable privilege escalation or remote code execution (Red Hat CVE, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability requires local access to a system running a nested overlayfs configuration, limiting the attack surface. The EPSS score is approximately 0.186% (9th percentile), indicating a low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Red Hat CVE).

Apply the upstream Linux kernel patch that corrects backing_file_open() to use file_user_path() instead of user_file->f_path. Fixed kernel versions include 6.12.109 (for the 6.12.x stable branch), 6.18.50 (for the 6.18.x branch), 7.2.4 (for the 7.2.x branch), and 7.3-rc1 (mainline). Users should update to a patched kernel version provided by their Linux distribution (e.g., Red Hat, Debian, Ubuntu) as soon as packages become available. No configuration-based workaround is known; avoiding nested overlayfs configurations may reduce exposure in environments where patching is delayed (Red Hat CVE, Github Advisory).