GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-53174 (GCVE-0-2026-53174)

Vulnerability from cvelistv5 – Published: 2026-06-25 08:38 – Updated: 2026-08-05 12:33
VLAI
Title
ovl: keep err zero after successful ovl_cache_get()
Summary
In the Linux kernel, the following vulnerability has been resolved: ovl: keep err zero after successful ovl_cache_get() ovl_iterate_merged() stores PTR_ERR(cache) in err before checking IS_ERR(cache). On success err holds the truncated cache pointer and can be returned as a bogus non-zero error. The syzbot reproducer reaches this through overlay-on-overlay readdir: getdents64 iterate_dir(outer overlay file) ovl_iterate_merged() ovl_cache_get() ovl_dir_read_merged() ovl_dir_read() iterate_dir(inner overlay file) ovl_iterate_merged() Only compute PTR_ERR(cache) on the error path.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d25e4b739f8378419f990983f2542160e79738c5 , < e7051909a01bfb883bfa78b27514854068ac4b85 (git)
Affected: d25e4b739f8378419f990983f2542160e79738c5 , < 1711b6ed6953cee5940ca4c3a6e77f1b3798cee2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 7.0.13 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/overlayfs/readdir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e7051909a01bfb883bfa78b27514854068ac4b85",
              "status": "affected",
              "version": "d25e4b739f8378419f990983f2542160e79738c5",
              "versionType": "git"
            },
            {
              "lessThan": "1711b6ed6953cee5940ca4c3a6e77f1b3798cee2",
              "status": "affected",
              "version": "d25e4b739f8378419f990983f2542160e79738c5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/overlayfs/readdir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\novl: keep err zero after successful ovl_cache_get()\n\novl_iterate_merged() stores PTR_ERR(cache) in err before checking\nIS_ERR(cache). On success err holds the truncated cache pointer and\ncan be returned as a bogus non-zero error.\n\nThe syzbot reproducer reaches this through overlay-on-overlay readdir:\n\n  getdents64\n    iterate_dir(outer overlay file)\n      ovl_iterate_merged()\n        ovl_cache_get()\n          ovl_dir_read_merged()\n            ovl_dir_read()\n              iterate_dir(inner overlay file)\n                ovl_iterate_merged()\n\nOnly compute PTR_ERR(cache) on the error path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local filesystem syscalls, specifically opening/enumerating nested overlayfs directories with getdents/getdents64. It is not reachable from network packets or adjacent/physical input.\nAC:L - The attacker controls the overlay-on-overlay setup and the readdir/getdents trigger, and syzbot demonstrated reproducible crashes. Any pointer-value dependency can be retried or influenced with local heap grooming, so no uncontrollable race or victim state is required.\nPR:L - Creating the crafted overlayfs setup requires local privileges, but overlayfs is marked FS_USERNS_MOUNT and is reachable in a user namespace on systems allowing unprivileged user namespaces. Thus a basic local user is sufficient in the highest reasonable deployment scenario.\nUI:N - No victim action is needed once the attacker has local execution; the attacker mounts/prepares the nested overlay and invokes getdents directly. The vulnerable code runs synchronously in the attacker\u0027s syscall path.\nS:U - The impact remains within the kernel and the local system security authority. This is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug can convert a successful overlay directory-cache pointer into a bogus cache pointer and produce wild memory access in ovl_seek_cursor/ovl_iterate. On severe but reasonable architectures/configurations this can amount to stale/truncated kernel-pointer use, so kernel memory disclosure is defensible.\nI:H - The same wild-pointer/UAF-style path can cause overlayfs to interpret invalid or attacker-influenced memory as ovl_cache_entry state and perform cache-entry updates through it. Given the kernel memory corruption primitive and uncertainty, high integrity impact is the safer defensible choice.\nA:H - The public syzbot report is a general protection fault/Oops with KASAN wild-memory-access in ovl_iterate, reachable from getdents. A local attacker can repeatedly trigger this path to crash or panic affected kernels."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:33:43.620Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e7051909a01bfb883bfa78b27514854068ac4b85"
        },
        {
          "url": "https://git.kernel.org/stable/c/1711b6ed6953cee5940ca4c3a6e77f1b3798cee2"
        }
      ],
      "title": "ovl: keep err zero after successful ovl_cache_get()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53174",
    "datePublished": "2026-06-25T08:38:51.366Z",
    "dateReserved": "2026-06-09T07:44:35.389Z",
    "dateUpdated": "2026-08-05T12:33:43.620Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53174",
      "date": "2026-09-15",
      "epss": "0.0012",
      "percentile": "0.02114"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53174\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-25T09:16:34.747\",\"lastModified\":\"2026-07-06T12:44:52.313\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\novl: keep err zero after successful ovl_cache_get()\\n\\novl_iterate_merged() stores PTR_ERR(cache) in err before checking\\nIS_ERR(cache). On success err holds the truncated cache pointer and\\ncan be returned as a bogus non-zero error.\\n\\nThe syzbot reproducer reaches this through overlay-on-overlay readdir:\\n\\n  getdents64\\n    iterate_dir(outer overlay file)\\n      ovl_iterate_merged()\\n        ovl_cache_get()\\n          ovl_dir_read_merged()\\n            ovl_dir_read()\\n              iterate_dir(inner overlay file)\\n                ovl_iterate_merged()\\n\\nOnly compute PTR_ERR(cache) on the error path.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/overlayfs/readdir.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d25e4b739f8378419f990983f2542160e79738c5\",\"lessThan\":\"e7051909a01bfb883bfa78b27514854068ac4b85\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d25e4b739f8378419f990983f2542160e79738c5\",\"lessThan\":\"1711b6ed6953cee5940ca4c3a6e77f1b3798cee2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/overlayfs/readdir.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.13\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.13\",\"matchCriteriaId\":\"6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1EF7059-E670-45F4-B422-54C40FA86390\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D38F0BF-A728-4133-A358-D44A2F7EE6D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC732D08-5F7B-46D9-B154-E60C7F4F0A97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E5910A9D-F60A-409A-B486-FE66BFEBA9B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"81DFF19E-9CF8-49C6-8C36-1E4038622933\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B0E8FC71-3952-444C-83E9-718DBBBEC615\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1711b6ed6953cee5940ca4c3a6e77f1b3798cee2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e7051909a01bfb883bfa78b27514854068ac4b85\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-26T07:44:10+00:00",
      "cve": "CVE-2026-53174",
      "id": "CVE-2026-53174",
      "initial_release_date": "2026-06-25T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ovl: keep err zero after successful ovl_cache_get()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53174.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T01:14:19Z",
      "cve": "CVE-2026-53174",
      "id": "CVE-2026-53174",
      "initial_release_date": "2026-06-26T02:11:11Z",
      "product_status:known_not_affected": "293",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-53174",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-53174.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.