CVE-2026-98215

A flaw was found in the Linux kernel. When nested storage layers such as layered overlay filesystems are used, the SELinux subsystem fails to preserve the original user Security Identifier (SID, an identifier representing security permissions) across backing files. A local user could trigger this flaw during memory protection operations, causing permission checks to evaluate against an incorrect security context and potentially leading to unauthorized access or improper access denials.

SELinux can perform an fd use authorization check against the wrong target SID when mmap operates through nested backing files such as overlayfs over overlayfs or FUSE passthrough backed by overlayfs. The saved top level user SID can be replaced by the SID of the process that opened an intermediate backing file. This can incorrectly deny mprotect without a domain transition and can produce an incorrect authorization decision after a transition. For the CVSS the PR:L reflects that a local process must reach the affected nested backing file and invoke mmap or mprotect, while administrative privileges are not necessarily required if the mount topology already exists. AC:H reflects the need for a specific nested filesystem configuration, SELinux enforcing mode, and a policy or domain transition that makes the incorrect SID relevant. The issue is not directly network reachable. Impact includes a confirmed local access denial and a plausible SELinux policy bypass with confidentiality or integrity impact depending on the installed policy and the mapped file.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.