CVE-2026-74595

A flaw was found in the Linux kernel's fscrypt component. When setting an encryption policy on an idmapped mount, the fscrypt_ioctl_set_policy() function incorrectly performs an owner check. This vulnerability can lead to legitimate users being denied access to set encryption policies, while unauthorized users might be wrongly permitted to do so, resulting in an access control bypass.

A moderate flaw was found in the Linux kernel's fscrypt subsystem, which is used by Red Hat Enterprise Linux and Red Hat In-Vehicle OS. When setting a file encryption policy, the fscrypt_ioctl_set_policy() function performs its file-ownership check using &nop_mnt_idmap instead of the idmap of the mount on which the ioctl was issued. On idmapped mounts of filesystems that support both fscrypt and idmapped mounts (such as ext4 and f2fs), the caller's fsuid is therefore compared against the unmapped on-disk inode owner rather than the mapped owner. As a result, the real owner of a file can be wrongly denied the ability to set an encryption policy with -EACCES, while an unrelated local user can be wrongly allowed to set an encryption policy on files they do not own, an access-control bypass whose primary impact is availability (files could be encrypted under a policy/key that makes them inaccessible to their owner). Red Hat rated this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) rather than the upstream/CVEORG Important (7.8) because exploitation requires local access to a system specifically configured with idmapped mounts. Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2 are affected; Red Hat Enterprise Linux 6, 7, and 8 streams are not affected because the vulnerable code is not present. Because of the Moderate severity rating and the specialized configuration required to trigger this flaw, the fix is being deferred to a future maintenance update of the affected streams; the residual risk is that a local user with access to an idmapped mount could set an encryption policy on files they do not own and potentially render those files inaccessible.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.