CVE-2026-53174: Linux Kernel Overlay Error Vulnerability

CVE-2026-53174 Overview

CVE-2026-53174 is a Linux kernel vulnerability in the overlayfs (ovl) subsystem. The flaw lives in ovl_iterate_merged(), which incorrectly stores PTR_ERR(cache) into the err variable before validating the pointer with IS_ERR(cache). On the success path, err ends up holding the truncated cache pointer value and can be returned as a spurious non-zero error code to callers of getdents64 and related directory iteration paths.

The issue was identified through a syzbot reproducer that exercised an overlay-on-overlay readdir scenario. The fix constrains PTR_ERR(cache) computation to the error path only.

Critical Impact
Local users performing directory iteration on stacked overlayfs mounts may receive bogus error codes, leading to readdir failures and potential userspace application logic errors.

Affected Products

Linux kernel (overlayfs subsystem)
Stable kernel branches receiving the backport via commits 1711b6ed6953 and e7051909a01b
Systems mounting overlay filesystems, including container runtimes that stack overlayfs

Discovery Timeline

2026-06-25 - CVE-2026-53174 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53174

Vulnerability Analysis

The vulnerability resides in the merged directory iteration logic for overlayfs. ovl_iterate_merged() calls ovl_cache_get() to retrieve a directory cache structure. The original code assigned PTR_ERR(cache) to the local err variable before evaluating IS_ERR(cache). When ovl_cache_get() succeeds, cache is a valid kernel pointer rather than an encoded error value. Casting that pointer through PTR_ERR() yields a truncated integer that is treated as a non-zero error code on return.

The syzbot reproducer triggers the path through a stacked configuration: a getdents64 syscall on an outer overlay invokes iterate_dir(), which calls ovl_iterate_merged(). That function then calls ovl_cache_get() → ovl_dir_read_merged() → ovl_dir_read(), which itself performs iterate_dir() on an inner overlay file, recursing into ovl_iterate_merged() again. The recursive overlay-on-overlay path makes the success branch reachable in a way that surfaces the bogus error to userspace.

Root Cause

The defect is an ordering bug between error encoding and pointer validation. The code unconditionally captured PTR_ERR(cache) before checking IS_ERR(cache), causing err to retain a non-zero value derived from a valid pointer on success. This falls under improper error handling and is closely related to logic errors that produce misleading return values from kernel filesystem operations.

Attack Vector

The vector is local. An unprivileged user with the ability to mount or interact with overlayfs—directly or via container tooling—can trigger directory iteration on stacked overlay mounts. The result is incorrect error propagation to readdir callers rather than memory corruption or privilege escalation. The vulnerability is reachable through standard getdents64 system calls on affected mounts.

The upstream patch restricts PTR_ERR(cache) computation to the branch taken when IS_ERR(cache) is true, ensuring err remains zero on success. See the kernel commit 1711b6ed6953 and the stable backport e7051909a01b for the exact change.

Detection Methods for CVE-2026-53174

Indicators of Compromise

Unexpected non-zero return codes from getdents64 syscalls against overlayfs mount points where directories should iterate successfully.
Application-level readdir failures on container layers or stacked overlay mounts without corresponding filesystem errors in dmesg.
Kernel versions predating the ovl_iterate_merged() fix referenced in the upstream commits.

Detection Strategies

Inventory running kernel versions across Linux hosts and compare against the patched stable releases referenced in the upstream commits.
Audit container runtime hosts (Docker, containerd, Podman, Kubernetes nodes) for overlayfs usage and unpatched kernels.
Review syscall telemetry for anomalous getdents64 error returns paired with overlay mount paths.

Monitoring Recommendations

Collect uname -r and package inventory data via configuration management to track kernel patch status fleet-wide.
Enable auditd rules for mount events involving overlay filesystem types to identify hosts exposing the affected code path.
Correlate userspace application errors referencing directory iteration with host kernel versions to surface affected workloads.

How to Mitigate CVE-2026-53174

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution containing commits 1711b6ed6953 and e7051909a01b.
Reboot affected hosts after kernel installation to load the patched image.
Prioritize patching on container hosts and build systems where overlayfs is heavily exercised.

Patch Information

The fix is upstream in the Linux kernel and has been backported to stable branches. The mainline commit 1711b6ed6953 and the stable commit e7051909a01b constrain PTR_ERR(cache) evaluation to the error path inside ovl_iterate_merged(). Distribution vendors will ship the fix through standard kernel security update channels.

Workarounds

Avoid stacking overlay filesystems on top of other overlay mounts where feasible, as the reproducer requires overlay-on-overlay readdir.
Restrict unprivileged user namespace creation if not required, reducing the attack surface for overlayfs interactions by non-root users.
Validate readdir return codes in critical userspace applications to fail gracefully on spurious errors until the kernel patch is deployed.

bash

# Verify running kernel and check for the fix in the changelog
uname -r
rpm -q --changelog kernel | grep -i 'ovl_iterate_merged\|ovl_cache_get' | head
# Debian/Ubuntu equivalent
dpkg -l | grep linux-image
apt changelog linux-image-$(uname -r) | grep -i 'ovl_iterate_merged\|overlayfs'