CVE-2026-68448

A flaw was found in the Linux kernel's overlayfs component. When copying files across different overlay filesystems, the system incorrectly checked read permissions using the destination filesystem's credentials instead of the source's. This oversight could allow an unauthorized user to read files that should otherwise be restricted, leading to information disclosure.

A read permission bypass in overlayfs can occur during cross-sb copy_file_range because the source read access check may be evaluated with the destination overlayfs mounter credentials instead of the source overlayfs mounter credentials. A local user who can access suitable overlayfs mounts may be able to copy data from a source file that should otherwise be denied by the source mount policy. For the CVSS the PR:L is used because triggering requires local code execution or a local process able to invoke copy_file_range on the affected mounts, but it does not normally require full administrator privileges once the vulnerable mount layout exists. The issue is not network reachable and is triggered through a local filesystem operation. Impact is confidentiality loss due to unauthorized file read or copy, with no direct evidence of memory corruption, kernel crash, or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.