CVE-2026-64596: Linux Kernel Privilege Escalation Flaw

CVE-2026-64596 Overview

CVE-2026-64596 affects the Linux kernel's libfs subsystem. The init_pseudo() helper failed to set SB_I_NOEXEC and SB_I_NODEV flags on pseudo filesystem superblocks by default. Since commit 1e7ab6f67824 ("anon_inode: rework assertions"), path_noexec() warns when an anonymous-inode file is mmap'd from a superblock lacking SB_I_NOEXEC. The dma-buf subsystem backs its files this way without setting the flag, so any mmap of an exported buffer triggers the warning on kernels built with CONFIG_DEBUG_VFS=y. The fix sets both flags by default in init_pseudo() so every pseudo filesystem inherits them.

Critical Impact
Executable memory mappings of pseudo filesystem file descriptors, such as dma-buf handles, now correctly fail with -EPERM, enforcing the intended no-execute invariant on kernel-internal filesystems.

Affected Products

Linux kernel builds using init_pseudo() for pseudo filesystem setup
Kernels affected by the path_noexec() warning introduced by commit 1e7ab6f67824
Subsystems backing files with anonymous inodes such as dma-buf

Discovery Timeline

2026-08-06 - CVE-2026-64596 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-64596

Vulnerability Analysis

The issue resides in fs/libfs.c where init_pseudo() establishes internal SB_NOUSER mounts for pseudo filesystems. These mounts are never reachable through a filesystem path, yet the helper did not apply the SB_I_NOEXEC and SB_I_NODEV inode-side flags to their superblocks. After commit 1e7ab6f67824 reworked assertions on anonymous inodes, path_noexec() began emitting a WARNING at fs/exec.c:118 whenever such a file was mapped through do_mmap(). The dma-buf driver relies on anonymous inodes for its exported buffer file descriptors and never explicitly set SB_I_NOEXEC, so every mmap of a dma-buf fd tripped the warning on debug kernels.

Root Cause

The root cause is a missing default flag assignment in the pseudo filesystem initialization path. Each caller of init_pseudo() was expected to opt in to SB_I_NOEXEC and SB_I_NODEV, but dma-buf and similar consumers omitted this step. The assertion introduced by 1e7ab6f67824 requires the flag on any superblock backing anonymous-inode files, exposing the inconsistency as a CONFIG_DEBUG_VFS=y warning.

Attack Vector

This vulnerability is a kernel correctness and hardening issue rather than a remote attack surface. On affected kernels a local user process invoking mmap on a dma-buf file descriptor triggered the path_noexec warning. With the fix applied, requests for PROT_EXEC mappings of pseudo-fs file descriptors are refused with -EPERM, which is the invariant the assertion enforces. No in-tree caller maps these executable.

The vulnerability manifests in the init_pseudo() helper in fs/libfs.c. See the referenced kernel commits for the exact patch content.

Detection Methods for CVE-2026-64596

Indicators of Compromise

Kernel log entries containing WARNING: CPU: ... at fs/exec.c:118 path_noexec+0x47/0x50 on CONFIG_DEBUG_VFS=y builds
Stack traces showing do_mmap, vm_mmap_pgoff, ksys_mmap_pgoff, and __x64_sys_mmap above path_noexec
Reproducer output from tools/testing/selftests/dmabuf-heaps/dmabuf-heap -t system triggering the warning

Detection Strategies

Review kernel logs via dmesg and journalctl -k for path_noexec warnings originating from pseudo filesystem mounts
Audit local processes that request PROT_EXEC mappings against file descriptors returned by pseudo filesystem APIs such as dma-buf
Track kernel package versions against the fix commits 6de2aeff, 8e931557, and b9d45d32 on stable branches

Monitoring Recommendations

Forward kernel warning messages to a centralized log platform and alert on new path_noexec occurrences
Monitor for post-patch mmap failures returning -EPERM on pseudo filesystem file descriptors, which indicate the enforcement is active
Track deployment of updated stable kernels across Linux fleets to confirm remediation coverage

How to Mitigate CVE-2026-64596

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 6de2aeff, 8e931557, and b9d45d32 from the stable tree
Rebuild or update distribution kernels to a release that includes the init_pseudo() flag change
Reboot affected systems into the patched kernel to activate the corrected superblock flags

Patch Information

The fix updates init_pseudo() to set both SB_I_NOEXEC and SB_I_NODEV on the resulting superblock so every pseudo filesystem inherits them by default. Refer to Kernel Git Commit 6de2aeff, Kernel Git Commit 8e931557, and Kernel Git Commit b9d45d32 for the exact source changes.

Workarounds

Disable CONFIG_DEBUG_VFS in kernel builds to suppress the warning without addressing the underlying flag inconsistency
Audit third-party kernel modules that create pseudo filesystems and ensure they explicitly set SB_I_NOEXEC and SB_I_NODEV until a patched kernel is deployed
Restrict local workloads that call mmap with PROT_EXEC on pseudo filesystem file descriptors while patching is in progress

bash

# Verify kernel version and confirm patched build is running
uname -r
dmesg | grep -i path_noexec