Answer in brief
CVE-2026-64294 records a Medium severity (CVSS 5.5) vulnerability in mm: do file ownership checks with the proper mount idmap. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=9caccd41541a6f7d6279928d9f971f6642c361af <744b23aa430d52f5c8e4dbff7d71496d6643bed2 || >=9caccd41541a6f7d6279928d9f971f6642c361af <8344bdf0629457e532797b42d9d2bbf2a2900bbf || >=9caccd41541a6f7d6279928d9f971f6642c361af <5c942ad7df75925ee166e7f0fb36892d8dde376b || >=9caccd41541a6f7d6279928d9f971f6642c361af <04ba248d02d9eaa3d9077b00a6134caa75fa3e90 || >=9caccd41541a6f7d6279928d9f971f6642c361af <e187bc02f8fa4226d62814592cf064ee4557c470 | 744b23aa430d52f5c8e4dbff7d71496d6643bed2, 8344bdf0629457e532797b42d9d2bbf2a2900bbf, 5c942ad7df75925ee166e7f0fb36892d8dde376b, 04ba248d02d9eaa3d9077b00a6134caa75fa3e90, e187bc02f8fa4226d62814592cf064ee4557c470 |
| Linux/Linuxgeneric | 5.12 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 12, 2026
In the Linux kernel, the following vulnerability has been resolved: mm: do file ownership checks with the proper mount idmap Ever since idmapped mounts were introduced, inode ownership checks (for side-channel protection) in mincore() and madvise(MADV_PAGEOUT) were done against the nop_mnt_idmap, which completely ignores the file's mount's idmap. This results in odd edgecases like: 1) mount/bind-mount with an idmap userA:userB:1 2) userB runs an owner_or_capable() check on file that is owned by userA on-disk/in-memory, but owned by userB after idmap translation 3) owner_or_capable() mysteriously fails as the correct idmap wasn't supplied In the case of mincore/madvise MADV_PAGEOUT, this is usually benign, because file_permission(file, MAY_WRITE) will probably succeed, as it uses the proper idmap internally, but it does not need to be the case on e.g a 0444 file where even the owner itself doesn't have permissions to write to it. Since this is clearly not trivial to get right, introduce a file_owner_or_capable() that can carry the correct semantics, and switch the various users in mm to it. The issue was found by manual code inspection & an off-list discussion with Jan Kara.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-64294 records a Medium severity (CVSS 5.5) vulnerability in mm: do file ownership checks with the proper mount idmap. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.2:rc2:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=9caccd41541a6f7d6279928d9f971f6642c361af <744b23aa430d52f5c8e4dbff7d71496d6643bed2 || >=9caccd41541a6f7d6279928d9f971f6642c361af <8344bdf0629457e532797b42d9d2bbf2a2900bbf || >=9caccd41541a6f7d6279928d9f971f6642c361af <5c942ad7df75925ee166e7f0fb36892d8dde376b || >=9caccd41541a6f7d6279928d9f971f6642c361af <04ba248d02d9eaa3d9077b00a6134caa75fa3e90 || >=9caccd41541a6f7d6279928d9f971f6642c361af <e187bc02f8fa4226d62814592cf064ee4557c470 | 744b23aa430d52f5c8e4dbff7d71496d6643bed2, 8344bdf0629457e532797b42d9d2bbf2a2900bbf, 5c942ad7df75925ee166e7f0fb36892d8dde376b, 04ba248d02d9eaa3d9077b00a6134caa75fa3e90, e187bc02f8fa4226d62814592cf064ee4557c470 |
| Linux/Linuxgeneric | 5.12 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 12, 2026
In the Linux kernel, the following vulnerability has been resolved: mm: do file ownership checks with the proper mount idmap Ever since idmapped mounts were introduced, inode ownership checks (for side-channel protection) in mincore() and madvise(MADV_PAGEOUT) were done against the nop_mnt_idmap, which completely ignores the file's mount's idmap. This results in odd edgecases like: 1) mount/bind-mount with an idmap userA:userB:1 2) userB runs an owner_or_capable() check on file that is owned by userA on-disk/in-memory, but owned by userB after idmap translation 3) owner_or_capable() mysteriously fails as the correct idmap wasn't supplied In the case of mincore/madvise MADV_PAGEOUT, this is usually benign, because file_permission(file, MAY_WRITE) will probably succeed, as it uses the proper idmap internally, but it does not need to be the case on e.g a 0444 file where even the owner itself doesn't have permissions to write to it. Since this is clearly not trivial to get right, introduce a file_owner_or_capable() that can carry the correct semantics, and switch the various users in mm to it. The issue was found by manual code inspection & an off-list discussion with Jan Kara.
Quoted source text, attributed separately from HOL analysis.