CVE-2026-98214 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
selinux: recheck intermediate backing files on mprotect()
mprotect() can be used to bypass the SELinux checks that mmap() performs against the intermediate layers of a stacked filesystem.
mmap() checks every backing layer as the request descends through the stack. mprotect() only has the lowest backing file in vma->vm_file, so it rechecks the top-level user and the lowest mounter, but skips the mounters of every layer in between. With two nested overlayfs mounts and a policy denying mounter_t -> middle_file_t:file { execute }, a direct
mmap(PROT_EXEC) is denied:
avc: denied { execute } for pid=71 comm="nested_exec"
path="/payload" dev="overlay" ino=9 scontext=user_u:base_r:mounter_t tcontext=user_u:object_r:middle_file_t tclass=file permissive=0
while mmap(PROT_NONE) followed by mprotect(PROT_EXEC) succeeds.
Preserve each intermediate path, mounter SID and file-description SID in the backing-file security blob, copying the saved entries when another backing layer is opened. Allocate the array only for nested backing files, and release it and the path references in the backing_file_free hook.
During mprotect(), recheck fd { use } and the requested inode permissions
for every saved mounter, and include the intermediate layers in the execmod checks. Policy for nested stacking may then need to grant intermediate mounters what a direct mmap() already requires, and execmod on intermediate labels for binaries using text relocations.
Tested on arm64 QEMU with a small BusyBox initramfs and a purpose-built SELinux policy, on a mainline tree containing commit f2381b546e7e ("fs: fix user path of nested backing files").
[PM: subject tweak]
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/06/2026
The Linux kernel vulnerability identified in the SELinux subsystem involves an inconsistency in how memory protection changes are validated against security policies compared to initial memory mappings. Specifically, the mprotect system call fails to perform comprehensive access control checks on intermediate layers of stacked filesystems, such as overlayfs mounts. While the mmap function correctly iterates through every backing layer in a stack to enforce SELinux policy constraints, mprotect relies solely on the lowest-level backing file stored within the virtual memory area structure. This architectural oversight allows an attacker to bypass security restrictions by initially mapping memory with no permissions and subsequently changing those protections to executable using mprotect, thereby circumventing checks that would otherwise deny execution based on the context of intermediate mounters or files in a nested filesystem hierarchy.
From a technical perspective, this flaw stems from the fact that vma->vm_file typically references only the final backing file rather than preserving the security contexts of all intermediate layers encountered during path resolution. When SELinux evaluates permissions for mmap, it inspects each layer's mounter and associated security identifiers to ensure compliance with the loaded policy. However, because mprotect does not retain or re-evaluate these intermediate states, it effectively ignores potential violations occurring at higher levels of the filesystem stack. For instance, if a policy denies execution from a user context through an intermediate file type, direct mmap calls are correctly blocked by the kernel's access vector cache checks. Yet, splitting the operation into two steps—first mapping with PROT_NONE and then calling mprotect to set PROT_EXEC—allows the process to execute code in memory that should have been restricted, exploiting the gap between initial creation and subsequent modification of memory permissions.
The operational impact of this vulnerability is significant for systems relying on SELinux or similar mandatory access control mechanisms to enforce strict isolation policies. Attackers can leverage this bypass to execute arbitrary code within processes where execution was explicitly denied by policy rules governing intermediate file layers. This capability undermines the integrity of security boundaries, particularly in environments utilizing complex filesystem stacking like overlayfs commonly found in containerized workloads and virtualization platforms. The ability to escalate privileges or inject malicious payloads into protected memory spaces can lead to full system compromise if combined with other exploitation techniques targeting kernel vulnerabilities or application logic flaws that depend on SELinux enforcement for defense-in-depth strategies.
To mitigate this risk, the Linux kernel has been patched to preserve intermediate path information and security identifiers within the backing-file security blob during file operations involving nested layers. The updated implementation allocates storage only when necessary for stacked filesystems and ensures that mprotect rechecks both file descriptor usage rights and inode permissions against every saved mounter context before allowing permission changes. Administrators must ensure their SELinux policies account for these intermediate labels, potentially granting appropriate execmod or execute permissions to middle-layer contexts if legitimate applications require such access through nested mounts. Additionally, organizations should apply the relevant kernel updates promptly and verify that security monitoring tools detect any anomalous patterns of memory protection modifications following policy denials, aligning remediation efforts with industry standards for vulnerability management and secure configuration practices.
This issue relates directly to CWE-284 Improper Access Control, as it represents a failure in enforcing intended restrictions on resource access due to incomplete validation logic within the operating system kernel. Furthermore, from an adversarial perspective, this technique aligns with ATT&CK tactic T1059 Command and Scripting Interpreter subtechniques involving dynamic code execution or memory manipulation strategies where attackers modify existing processes rather than creating new ones entirely. By addressing these gaps through rigorous patch management and policy review, defenders can restore the effectiveness of mandatory access controls in protecting against unauthorized code execution within complex filesystem environments.