CVE-2026-52791

A flaw was found in fuse-overlayfs, a component used for rootless containers. This vulnerability allows a low-privileged process to retain SUID (Set User ID) and SGID (Set Group ID) permissions on files after they are truncated or opened with the O_TRUNC flag. This can enable a local attacker to manipulate file permissions, potentially leading to privilege escalation within the system.

Red Hat is aware of this issue affecting fuse-overlayfs, which is used as an optional, non-default storage backend for rootless Podman/Buildah on kernels or configurations where native (kernel) overlayfs support for user namespaces is unavailable. On currently supported Red Hat Enterprise Linux releases (RHEL >= 8.5 / RHEL 9 / RHEL 10), rootless Podman uses native kernel overlayfs by default; fuse-overlayfs is only invoked as a fallback or when explicitly configured via storage.conf's mount_program option, or in nested/unprivileged container scenarios (e.g. rootless Buildah image builds) that lack CAP_SYS_ADMIN. Exploitation additionally requires a pre-existing file in the container's lower image layer that already carries the SUID or SGID bit and is writable by a low-privileged process, an atypical container image configuration. Red Hat rates the overall risk of this issue as reduced relative to a generic worst-case rating given these preconditions; see the private triage comment on this flaw for the full reachability and CVSS analysis.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid configuring fuse-overlayfs as the storage mount_program for rootless Podman/Buildah where native overlayfs support is available (this is not the default on supported RHEL releases). Ensure container images do not ship world- or group-writable files with the SUID or SGID bit set. No other mitigation is available prior to upgrading to fuse-overlayfs >= 1.17.