CVE-2026-98214
Low risk· EPSS 12%Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A vulnerability was found in the Linux kernel's SELinux module that allows bypassing access controls during mprotect() calls in nested overlayfs filesystems. An attacker can gain code execution permissions that should be denied by SELinux policy via a sequence of mmap(PROT_NONE) followed by mprotect(PROT_EXEC).
Risk Assessment
The risk involves bypassing SELinux protections and executing unauthorized code in a process context, potentially leading to privilege escalation or system integrity compromise in environments using nested overlayfs.
Recommendation
Immediately apply the kernel patch provided by the Linux vendor for this vulnerability and update to a kernel version containing the fix. Also review SELinux policies to ensure proper permissions for nested mounts.
Other vulnerabilities in Linux kernel
See all- CVE-2026-118593Medium
A flaw was found in Red Hat Enterprise Linux 9 kernel builds. An incomplete backport of the CVE-2026-46099 fix in RHEL 9.6 through 9.10 left a local_bh imbalance in seg6_input_core(), where the drop path returns with bottom halves still disabled. This can lead to softirq starvation and denial of service on systems with SRv6 tunnels configured. Upstream and RHEL 10 are not affected.
- CVE-2026-99216Unknown
In the Linux kernel, the Hyper-V (hv) driver incorrectly forces the VMBus connection state to DISCONNECTED before calling vmbus_disconnect(). As a result, vmbus_initiate_unload() does not unload the connection because it only acts when the state is CONNECTED, so the Hyper-V host may continue sending messages or posting VMBus interrupts.
- CVE-2026-99215Unknown
In the Linux kernel power supply subsystem, a use-after-free vulnerability exists. If a power supply is unregistered while its external_power_changed() callback is still running, the driver may free data that the callback is still accessing, leading to a kernel crash (NULL pointer dereference).
- CVE-2026-99214Unknown
In the Linux kernel, the drm/vc4 HDMI driver has an ordering issue with Packet RAM enabling. When audio is triggered by the HPD handler before video is restored, vc4_hdmi_write_infoframe() may attempt to store an infoframe while Packet RAM is disabled, causing a kernel warning (splat). The fix moves Packet RAM enable/disable into the Runtime PM hooks.
- CVE-2026-99213Unknown
In the Linux kernel vsock subsystem, the TCP_ESTABLISHED to TCP_CLOSING transition on OP_RST can race with the connect loop. Resetting a socket still present in connected_table can lead to memory corruption, including a double list add and a kernel BUG.
- CVE-2026-99212Unknown
In the Linux kernel net/rds module, rds_rdma_cm_event_handler_cmn() returns the result of rdma_resolve_route() directly to rdma_cm on RDMA_CM_EVENT_ADDR_RESOLVED. A synchronous failure causes the id ic->i_cm_id to be destroyed while RDS still owns it, leading to use of a freed id during connection shutdown.
- CVE-2026-99211Unknown
In the Linux kernel netlink subsystem, socket filters can use SKF_NET_OFF and SKF_LL_OFF to read relative to an skb's network and MAC headers. Netlink producers may reserve headroom without resetting those headers, allowing a receiving socket's filter to read data before the initialized message and disclose memory contents.
- CVE-2026-99210Unknown
In the Linux kernel accel/rocket driver, rocket_probe() stores the return value of rocket_device_init() in the file-scoped rdev pointer before checking whether it is an error pointer. On failure rdev remains an ERR_PTR, and a later probe can skip initialization and dereference the error pointer when reading rdev->num_cores.
- CVE-2026-99209Unknown
In the Linux kernel drm/xe driver, xe_evict_flags() reads tbo->resource->mem_type, but a BO can reach eviction with no ttm.resource, e.g. an imported dma-buf whose resource was freed during teardown. This causes a NULL pointer dereference and a kernel fault.
- CVE-2026-99208Unknown
In the Linux kernel drm/xe/oa driver, ttm_bo_type_kernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale kernel memory contents.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: selinux: recheck intermediate backing files on mprotect() mprotect() can be used to bypass the SELinux checks that mmap() performs against the intermediate layers of a stacked filesystem. mmap() checks every backing layer as the request descends through the stack. mprotect() only has the lowest backing file in vma->vm_file, so it rechecks the top-level user and the lowest mounter, but skips the mounters of every layer in between. With two nested overlayfs mounts and a policy denying mounter_t -> middle_file_t:file { execute }, a direct mmap(PROT_EXEC) is denied: avc: denied { execute } for pid=71 comm="nested_exec" path="/payload" dev="overlay" ino=9 scontext=user_u:base_r:mounter_t tcontext=user_u:object_r:middle_file_t tclass=file permissive=0 while mmap(PROT_NONE) followed by mprotect(PROT_EXEC) succeeds. Preserve each intermediate path, mounter SID and file-description SID in the backing-file security blob, copying the saved entries when another backing layer is opened. Allocate the array only for nested backing files, and release it and the path references in the backing_file_free hook. During mprotect(), recheck fd { use } and the requested inode permissions for every saved mounter, and include the intermediate layers in the execmod checks. Policy for nested stacking may then need to grant intermediate mounters what a direct mmap() already requires, and execmod on intermediate labels for binaries using text relocations. Tested on arm64 QEMU with a small BusyBox initramfs and a purpose-built SELinux policy, on a mainline tree containing commit f2381b546e7e ("fs: fix user path of nested backing files"). [PM: subject tweak]
Vulnerability data from NVD (NIST) · CISA KEV · EPSS