CVE-2026-89768

A flaw was found in the Linux kernel's filesystem (fs) component. When using nested overlay filesystems (overlayfs), a local user could exploit an issue where the backing_file_open() function incorrectly derives the path for mapped files. This vulnerability leads to information disclosure, as files mapped through a nested overlayfs display an incorrect path in /proc/<pid>/maps and perf/ftrace mmap records.

A moderate severity flaw was found in the Linux kernel's stacking filesystem backing-file handling. When backing_file_open() is called with a user file that is itself a backing file, as happens with nested overlayfs mounts (for example, an overlay whose lowerdir is the merged directory of another overlay), the path stored in the new backing file is derived from the intermediate backing file's f_path instead of the user-visible path. As a result, files mapped through a nested overlayfs display an incorrect, disconnected path in /proc/<pid>/maps and in perf/ftrace mmap records, disclosing misleading path information; the same incorrect path derivation also affects fuse passthrough and erofs ishare when their user file is itself a backing file. Exploitation requires local access and the ability to create the nested stacking filesystem configuration. Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt), OpenShift Container Platform 4 and 5 releases shipping RHEL CoreOS 9, and Red Hat In-Vehicle OS are affected. Fixes for these products are currently deferred: the issue was assessed as low security impact for the affected components and no update trackers are filed for that severity, so the residual risk is limited to incorrect path reporting for mapped files in nested stacking filesystem configurations. Red Hat Enterprise Linux 6, 7, and 8 and OpenShift Container Platform 4.12 (RHEL CoreOS 8 based) are not affected because the vulnerable code is not present in those kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.