CVE-2026-52791: fuse-overlayfs Privilege Escalation Issue

CVE-2026-52791 Overview

CVE-2026-52791 affects fuse-overlayfs, a FUSE-based implementation of overlayfs used for rootless containers. Versions prior to 1.17 on the release-1.x C branch preserve SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate handling on copied-up files. A low-privileged process can leave an upper-layer file with mode 4777, retaining setuid semantics on a file it controls. The issue is classified under [CWE-266: Incorrect Privilege Assignment] and is fixed in version 1.17.

Critical Impact
A local, low-privileged user in a rootless container context can retain SUID/SGID bits on a truncated copy-up file, creating conditions for local privilege escalation on the host if the file is later executed in a trusted context.

Affected Products

fuse-overlayfs release-1.x C branch, all versions prior to 1.17
Rootless container runtimes that depend on fuse-overlayfs for overlay storage
Container platforms bundling vulnerable fuse-overlayfs (Podman, Buildah, and similar rootless workflows)

Discovery Timeline

2026-07-29 - CVE-2026-52791 published to NVD
2026-07-29 - Last updated in NVD database
v1.17 - containers/fuse-overlayfs releases patched build (GitHub Release v1.17)

Technical Details for CVE-2026-52791

Vulnerability Analysis

fuse-overlayfs implements overlay filesystem semantics in user space so that unprivileged users can stack container image layers. When a process modifies a file that only exists in a lower layer, fuse-overlayfs performs a copy-up into the upper layer. On POSIX filesystems, truncating a file with open(O_TRUNC) or truncate() must clear the S_ISUID and S_ISGID bits when the caller is not privileged. This clearing behavior is required by POSIX to prevent unprivileged users from creating setuid or setgid files.

The vulnerable release-1.x branch does not clear these bits in main.c during truncate handling on the copy-up path. As a result, a low-privileged process can end up owning an upper-layer file with mode 4777, retaining SUID/SGID semantics after modifying content it controls.

Root Cause

The root cause is a missing chmod-equivalent call after truncate operations on copied-up files. The upstream fix introduces a clear_suid_sgid() helper that masks off S_ISUID and S_ISGID from node->ino->mode and applies the change via do_fchmod or do_chmod. Before the fix, the truncate paths never invoked this logic, so the elevated mode bits from the lower layer persisted into the writable upper layer.

Attack Vector

Exploitation requires local access with low privileges inside an environment using fuse-overlayfs for storage. An attacker identifies a lower-layer file carrying SUID or SGID bits, triggers a copy-up via open(O_TRUNC) or truncate(), and inspects the resulting upper-layer file. The attacker now controls file contents while the mode retains 4777. Depending on how the host or container later consumes the file, this can facilitate privilege escalation.

/* Upstream patch: main.c - clear SUID/SGID bits on truncate */
/* Make sure it is not used anymore.  */
#define chmod ERROR

static int
clear_suid_sgid (struct ovl_data *lo, struct ovl_node *node, int fd, const char *path)
{
  mode_t mode = node->ino->mode;

  if ((mode & (S_ISUID | S_ISGID)) == 0)
    return 0;

  mode &= ~(S_ISUID | S_ISGID);
  node->ino->mode = mode;

  if (fd >= 0)
    return do_fchmod (lo, node, fd, mode);

  return do_chmod (lo, node, path, mode);
}

static int
set_fd_origin (int fd, const char *origin)
{

Source: containers/fuse-overlayfs commit 97e0d96

Detection Methods for CVE-2026-52791

Indicators of Compromise

Files in fuse-overlayfs upper-layer directories owned by unprivileged users with mode 4777, 4755, 2777, or 2755
Setuid or setgid files inside rootless container storage paths such as ~/.local/share/containers/storage/overlay/*/diff
Recently truncated files in upper layers that inherit executable and setuid bits without matching lower-layer ownership

Detection Strategies

Enumerate upper-layer diff directories with find <upperdir> -perm /6000 -type f and correlate ownership against expected image metadata
Audit fuse-overlayfs process invocations and installed package version; flag hosts running the release-1.x C branch below 1.17
Compare mode bits between lower-layer and upper-layer copies of the same inode; unexpected retention of S_ISUID/S_ISGID after user writes indicates the vulnerable code path

Monitoring Recommendations

Enable Linux audit rules for chmod, fchmod, truncate, and ftruncate syscalls inside rootless container storage roots
Track invocations of setuid binaries whose paths resolve inside overlay diff directories rather than trusted system locations
Alert on new setuid files appearing in user-writable storage after container build or runtime activity

How to Mitigate CVE-2026-52791

Immediate Actions Required

Upgrade fuse-overlayfs to version 1.17 or later on all hosts using rootless container storage
Inventory rootless container hosts and identify installations of the release-1.x C branch below 1.17
Scan existing upper-layer directories for files carrying S_ISUID or S_ISGID and remove the bits where inappropriate

Patch Information

The fix is included in fuse-overlayfs 1.17. The upstream commit 97e0d968a782fc259ebde112db1e9b9ff1ad724f adds the clear_suid_sgid() helper and wires it into the truncate and O_TRUNC paths. Reference material: GHSA-2cc4-p72c-v85h, GitHub Release v1.17, and commit 97e0d96.

Workarounds

Where upgrade is not immediately possible, restrict use of rootless containers with fuse-overlayfs on multi-tenant hosts
Sweep upper-layer directories periodically and strip SUID/SGID bits from files under user-writable storage roots
Prefer kernel-native overlayfs with rootless support (available on recent kernels) over the FUSE implementation where feasible

bash

# Identify and clear residual SUID/SGID files under rootless container storage
STORAGE="$HOME/.local/share/containers/storage/overlay"
find "$STORAGE" -type f -perm /6000 -print
find "$STORAGE" -type f -perm /6000 -exec chmod u-s,g-s {} +

# Verify installed fuse-overlayfs version is >= 1.17
fuse-overlayfs --version