CVE-2026-74619: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-74619 Overview

CVE-2026-74619 is a Linux kernel vulnerability in the overlayfs (ovl) filesystem. An unprivileged local user can trigger a WARN_ON() condition in ovl_fill_super() by completing a filesystem context from a user namespace different from the one that created it. The condition can be raised in a loop to taint the kernel, flood the kernel log, or panic systems booted with panic_on_warn.

Critical Impact
Local unprivileged users can taint the kernel, flood system logs, or crash hosts booted with panic_on_warn by repeatedly triggering the overlayfs warning through cross-namespace fsconfig(FSCONFIG_CMD_CREATE) calls.

Affected Products

Linux kernel (upstream) with overlayfs enabled
Distributions shipping vulnerable overlayfs versions prior to the referenced stable commits
Systems configured with panic_on_warn are particularly exposed to denial-of-service impact

Discovery Timeline

2026-08-22 - CVE-2026-74619 published to NVD
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-74619

Vulnerability Analysis

The vulnerability resides in the overlayfs mount path. fsopen() records the caller's user namespace in fc->user_ns and returns an ordinary file descriptor. That descriptor is inheritable across fork() and exec() and can be passed over a Unix socket. Nothing binds the task calling fsconfig(FSCONFIG_CMD_CREATE) to the task that created the filesystem context.

Completing a context from another user namespace is intentionally permitted. vfs_cmd_create() authorizes the operation via mount_capable(), which for FS_USERNS_MOUNT filesystems checks ns_capable(fc->user_ns, CAP_SYS_ADMIN). This succeeds for any task holding CAP_SYS_ADMIN in an ancestor of fc->user_ns, including the initial user namespace.

When the mount completes in a namespace that differs from the one recorded during fsopen(), ovl_fill_super() reaches a WARN_ON() at fs/overlayfs/super.c:1551. Because the check is WARN_ON() rather than WARN_ON_ONCE(), the trace can be emitted repeatedly.

Root Cause

The overlayfs superblock initialization used an unconditional WARN_ON() to flag mounts completed from a different user namespace than the one that opened the filesystem context. This is a reachable state for unprivileged callers because fsconfig() does not repeat the may_mount() capability check that fsopen() performs [CWE-error handling]. Kernel warnings on user-reachable paths violate the guidance that WARN should mark impossible conditions.

Attack Vector

An unprivileged local user creates a new user namespace and mount namespace using unshare(1). Inside the child, the user calls fsopen("overlay", ...) to obtain a filesystem context file descriptor. The descriptor is passed back to a parent process, which issues fsconfig(FSCONFIG_CMD_CREATE). The mount is refused, but not before ovl_fill_super() triggers the warning. Repeating the sequence in a loop taints the kernel, generates unbounded log volume, and panics kernels booted with panic_on_warn=1.

No prior privileges are required. The observed process ran as UID 1000 in the reported stack trace, invoking get_tree_nodev, ovl_get_tree, vfs_get_tree, vfs_cmd_create, and __do_sys_fsconfig.

Detection Methods for CVE-2026-74619

Indicators of Compromise

Repeated kernel messages referencing WARNING: fs/overlayfs/super.c:1551 and ovl_fill_super
Kernel taint flags set after user-space activity from non-root UIDs
Unexpected kernel panics on hosts configured with panic_on_warn when unprivileged workloads are running
Elevated fsopen/fsconfig syscall volume from unprivileged processes combined with unshare activity

Detection Strategies

Audit dmesg, journalctl -k, and centralized log pipelines for the ovl_fill_super warning signature and correlate with the originating PID and UID.
Enable Linux audit rules on the fsopen, fsconfig, and unshare syscalls to identify unprivileged users creating user namespaces and overlayfs contexts.
Track kernel taint status (/proc/sys/kernel/tainted) across the fleet and alert on unexpected transitions.

Monitoring Recommendations

Forward kernel logs to a centralized data lake and alert on high-frequency WARN occurrences per host.
Baseline normal unshare and namespace-creation activity per workload and flag deviations from unprivileged accounts.
Monitor system availability metrics on hosts running with panic_on_warn for correlated reboot events.

How to Mitigate CVE-2026-74619

Immediate Actions Required

Apply the upstream overlayfs fix from the referenced stable kernel commits and rebuild or update affected kernels.
On systems where patching is delayed, disable panic_on_warn to prevent the warning from crashing the host.
Restrict unprivileged user namespace creation where the workload does not require it.

Patch Information

The fix removes the WARN_ON() while continuing to refuse the mount, aligning with the existing user-namespace check pattern already used by ovl_parse_param() for Opt_override_creds. Refer to the upstream commits: Kernel Git Commit 42d99fc, Kernel Git Commit 494346f, Kernel Git Commit 5134780, Kernel Git Commit 63981fc, and Kernel Git Commit be161fa.

Workarounds

Set kernel.unprivileged_userns_clone=0 on distributions that support it to block unprivileged user namespace creation.
Set kernel.panic_on_warn=0 at runtime via sysctl to prevent kernel panics until patches are applied.
Constrain container and sandbox workloads with seccomp profiles that deny fsopen, fsconfig, and unshare(CLONE_NEWUSER) where feasible.

bash

# Configuration example
sysctl -w kernel.panic_on_warn=0
sysctl -w kernel.unprivileged_userns_clone=0