CVE-2026-72379

A flaw was found in the Linux kernel's filesystem (fs) component. The vfs_tmpfile() function, used for creating temporary files with O_TMPFILE, did not properly verify if a caller's user and group IDs (fsuid and fsgid) were mapped within an idmapped mount. This oversight could allow a local user to create a temporary file with an invalid owner, specifically (uid_t)-1, bypassing intended security checks and potentially leading to unexpected file ownership and permissions.

A moderate impact flaw was found in the Linux kernel filesystem (VFS) subsystem. When creating an unnamed temporary file with the O_TMPFILE flag, the vfs_tmpfile() function did not verify that the caller's fsuid and fsgid map into the target filesystem, a check that all other file-creation paths (openat with O_CREAT, mkdir, mknod, symlink, link) already enforce by failing with -EOVERFLOW. On an idmapped mount whose idmapping does not cover the caller's user or group ID, a local unprivileged user could create a temporary file whose inode is initialized with the invalid owner (uid_t)-1, bypassing the intended ownership guarantee; because such an inode is created I_LINKABLE, it can later be spliced into the filesystem namespace with linkat(2), leaving a file whose owner the filesystem cannot represent. The flaw applies to filesystems that support idmapped mounts and implement ->tmpfile() (for example tmpfs, ext4, btrfs, XFS, f2fs) and to overlayfs, and it only manifests on the non-default idmapped-mount configuration; on non-idmapped mounts the missing check has no effect. Red Hat Enterprise Linux 9 and 10 and Red Hat In-Vehicle OS 2 are affected, with fixes currently deferred; the residual risk is limited because exploitation requires local access to an idmapped mount that does not map the caller's IDs, and the consequence is incorrect file ownership rather than memory corruption or direct privilege escalation. Red Hat Enterprise Linux 7 and 8 are not affected because the vulnerable code is not present in those kernels, and Red Hat Enterprise Linux 6 is out of support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This flaw only manifests on an idmapped mount whose idmapping does not cover the caller's fsuid or fsgid; on non-idmapped mounts the missing check has no effect. As a workaround, avoid using idmapped mounts, or ensure that the idmapping of every idmapped mount covers the user and group IDs of all users who are allowed to create files on that mount, so that O_TMPFILE creation cannot produce a file with an owner the filesystem cannot represent.