Medium 5.5Published Jul 25, 2026

CVE-2026-64294mm: do file ownership checks with the proper mount idmap

Updated under an hour ago (Oct 26, 2026, 7:00 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: mm: do file ownership checks with the proper mount idmap Ever since idmapped mounts were introduced, inode ownership checks (for side-channel protection) in mincore() and madvise(MADV_PAGEOUT) were done against the nop_mnt_idmap, which completely ignores the file's mount's idmap. This results in odd edgecases like: 1) mount/bind-mount with an idmap userA:userB:1 2) userB runs an owner_or_capable() check on file that is owned by userA on-disk/in-memory, but owned by userB after idmap translation 3) owner_or_capable() mysteriously fails as the correct idmap wasn't supplied In the case of mincore/madvise MADV_PAGEOUT, this is usually benign, because file_permission(file, MAY_WRITE) will probably succeed, as it uses the proper idmap internally, but it does not need to be the case on e.g a 0444 file where even the owner itself doesn't have permissions to write to it. Since this is clearly not trivial to get right, introduce a file_owner_or_capable() that can carry the correct semantics, and switch the various users in mm to it. The issue was found by manual code inspection & an off-list discussion with Jan Kara.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Aug 23, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 9caccd41541a6f7d6279928d9f971f6642c361af before 7368bec565bac3e536cd43579dbde1e715e6ba61; from 9caccd41541a6f7d6279928d9f971f6642c361af before b2f3d94ea310bea9d36d53e9d9b3f45e86c1d893; from 9caccd41541a6f7d6279928d9f971f6642c361af before 744b23aa430d52f5c8e4dbff7d71496d6643bed2; from 9caccd41541a6f7d6279928d9f971f6642c361af before 8344bdf0629457e532797b42d9d2bbf2a2900bbf; 9caccd41541a6f7d6279928d9f971f6642c361af builds before 5c942ad7df75925ee166e7f0fb36892d8dde376b; 9caccd41541a6f7d6279928d9f971f6642c361af builds before 04ba248d02d9eaa3d9077b00a6134caa75fa3e90; from 9caccd41541a6f7d6279928d9f971f6642c361af before e187bc02f8fa4226d62814592cf064ee4557c470	CNA record
linux linux_kernel linux:linux_kernel	from 5.12 before 6.6.145; from 6.7 before 6.12.96; from 6.13 before 6.18.39; from 6.19 before 7.1.4; 7.2; 7.2	NVD

References

References

https://git.kernel.org/stable/c/7368bec565bac3e536cd43579dbde1e715e6ba61
https://git.kernel.org/stable/c/b2f3d94ea310bea9d36d53e9d9b3f45e86c1d893
https://git.kernel.org/stable/c/744b23aa430d52f5c8e4dbff7d71496d6643bed2	patch
https://git.kernel.org/stable/c/8344bdf0629457e532797b42d9d2bbf2a2900bbf	patch
https://git.kernel.org/stable/c/5c942ad7df75925ee166e7f0fb36892d8dde376b	patch
https://git.kernel.org/stable/c/04ba248d02d9eaa3d9077b00a6134caa75fa3e90	patch
https://git.kernel.org/stable/c/e187bc02f8fa4226d62814592cf064ee4557c470	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.