--- cve: "CVE-2026-64294" severity: "LOW" cvss: 3.1 epss: "16%" vendor: "Linux" kev: false exploited: false published: "2026-07-25 10:17:10" tags: [cve, security, low] source: tsecurity.de CVE-Dossier exported: "2026-09-16T16:09:13+02:00" --- # CVE-2026-64294 > 3.1 LOW ## Beschreibung In the Linux kernel, the following vulnerability has been resolved: mm: do file ownership checks with the proper mount idmap Ever since idmapped mounts were introduced, inode ownership checks (for side-channel protection) in mincore() and madvise(MADV_PAGEOUT) were done against the nop_mnt_idmap, which completely ignores the file's mount's idmap. This results in odd edgecases like: 1) mount/bind-mount with an idmap userA:userB:1 2) userB runs an owner_or_capable() check on file that is owned by userA on-disk/in-memory, but owned by userB after idmap translation 3) owner_or_capable() mysteriously fails as the correct idmap wasn't supplied In the case of mincore/madvise MADV_PAGEOUT, this is usually benign, because file_permission(file, MAY_WRITE) will probably succeed, as it uses the proper idmap internally, but it does not need to be the case on e.g a 0444 file where even the owner itself doesn't have permissions to write to it. Since this is clearly not trivial to get right, introduce a file_owner_or_capable() that can carry the correct semantics, and switch the various users in mm to it. The issue was found by manual code inspection & an off-list discussion with Jan Kara. ## Patch verfügbar (OSV) - Kernel ≥ 5.15.217 - Kernel ≥ 6.1.184 - Kernel ≥ 6.6.145 - Kernel ≥ 6.12.96 - Kernel ≥ 6.18.39 - Kernel ≥ 7.1.4 ## Referenzen - - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-64294) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_