CVE-2026-74595 Linux CVE debrief

Who should care

Linux kernel maintainers, users of idmapped mounts with fscrypt-enabled filesystems like ext4 or f2fs, security teams responsible for monitoring and patching Linux systems, and operators managing Linux-based infrastructure. These stakeholders should assess exposure, prioritize patching, and monitor for potential exploitation attempts to mitigate the risk of privilege escalation and unauthorized access.

Why it matters

This vulnerability in the Linux kernel's fscrypt ioctl set policy functionality could lead to incorrect access control decisions on idmapped mounts, potentially allowing unauthorized access or denying legitimate access. Linux kernel maintainers and users, especially those using idmapped mounts with fscrypt-enabled filesystems, should assess exposure and prioritize patching.

• Potential privilege escalation on affected Linux systems
• Incorrect access control decisions on idmapped mounts
• Possible unauthorized access to sensitive data or system resources

Technical summary

The fscrypt_ioctl_set_policy() function in the Linux kernel incorrectly uses the nop_mnt_idmap instead of the mount's idmap for owner checks. This could lead to incorrect access control decisions on idmapped mounts, potentially allowing unauthorized access or denying legitimate access to sensitive data or system resources. The vulnerability affects Linux kernel versions and filesystems that support idmapped mounts, such as ext4 and f2fs, which use fscrypt for encryption. Affected users should review and apply patches promptly.

Defensive priority

High priority for Linux kernel maintainers and users, especially those using idmapped mounts with fscrypt-enabled filesystems like ext4 or f2fs.

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Assess the vulnerability's impact on systems using idmapped mounts with fscrypt-enabled filesystems
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and Linux kernel source code indicate a vulnerability in fscrypt ioctl set policy functionality. The issue involves incorrect usage of the nop_mnt_idmap instead of the mount's idmap for owner checks, potentially leading to incorrect access control decisions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.