---
cve: "CVE-2026-74619"
severity: "LOW"
cvss: 3.1
epss: "4.6%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-08-22 16:16:34"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-07T08:12:59+02:00"
---

# CVE-2026-74619

> 3.1 LOW

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

ovl: don't warn when the mount is completed from another user namespace

fsopen() records the caller's user namespace in fc->user_ns and hands
back an ordinary file descriptor. Nothing ties the task that calls
fsconfig(FSCONFIG_CMD_CREATE) to the task that created the context. The
fd is inherited across fork() and exec() and it can be passed over a
unix socket.

Completing a context from another user namespace is allowed on purpose.
vfs_cmd_create() authorizes the create with mount_capable(), which for
FS_USERNS_MOUNT checks ns_capable(fc->user_ns, CAP_SYS_ADMIN), and that
succeeds for a task holding CAP_SYS_ADMIN in an ancestor of fc->user_ns.
So an unprivileged task can reach the WARN_ON() in ovl_fill_super():
create a user and a mount namespace in a child, call fsopen("overlay")
there, send the fscontext fd to the parent and let the parent issue
FSCONFIG_CMD_CREATE. Both namespaces come from a plain unshare(1) and no
capability is needed anywhere:

  WARNING: fs/overlayfs/super.c:1551 at ovl_fill_super+0x7b9/0x1e20 [overlay]
  CPU: 3 UID: 1000 PID: 3243376 Comm: fswarn
  Call Trace:
   get_tree_nodev+0x71/0xa0
   ovl_get_tree+0x15/0x20 [overlay]
   vfs_get_tree+0x2a/0x100
   vfs_cmd_create+0x60/0xf0
   __do_sys_fsconfig+0x4b2/0x500

The child needs the mount namespace because fsopen() itself gates on
may_mount(), which asks for CAP_SYS_ADMIN in the user namespace owning
the caller's mount namespace. fsconfig() doesn't repeat that check.

It is a WARN_ON() and not a WARN_ON_ONCE(), so the condition can be
raised in a loop to taint the kernel and flood the log, and it panics a
kernel booted with panic_on_warn.

Keep refusing the mount and stop warning about it. ovl_parse_param()
already spells a user namespace check this way for Opt_override_creds.

## Patch verfügbar (OSV)

- Kernel ≥ 6.6.152
- Kernel ≥ 6.12.104
- Kernel ≥ 6.18.45
- Kernel ≥ 7.1.9

## Referenzen

- <https://git.kernel.org/stable/c/42d99fcd8006007e2f708bede6789f37f3910b30>
- <https://git.kernel.org/stable/c/494346f2aab2489d379d43ff614aea447cf4e94d>
- <https://git.kernel.org/stable/c/513478092966dc9818d96dd2b3ed613fd2f6e30e>
- <https://git.kernel.org/stable/c/63981fc786daaa626cb14d9be1406f674d79f98f>
- <https://git.kernel.org/stable/c/be161fa31e3e9cc828a3c1bd935edca461e8a7a1>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-74619) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_