{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-46054",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-46054"
  ],
  "published": "2026-05-27T12:59:23Z",
  "summary": "selinux: fix overlayfs mmap() and mprotect() access checks",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: fix overlayfs mmap() and mprotect() access checks\n\nThe existing SELinux security model for overlayfs is to allow access if\nthe current task is able to access the top level file (the \"user\" file)\nand the mounter's credentials are sufficient to access the lower\nlevel file (the \"backing\" file).  Unfortunately, the current code does\nnot properly enforce these access controls for both mmap() and mprotect()\noperations on overlayfs filesystems.\n\nThis patch makes use of the newly created security_mmap_backing_file()\nLSM hook to provide the missing backing file enforcement for mmap()\noperations, and leverages the backing file API and new LSM blob to\nprovide the necessary information to properly enforce the mprotect()\naccess controls.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": null,
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-46054"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/bc6c380c1159de52a252ed11f19a42c47f60a735"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/8bacd09f12c27710228562e4d13163e58c5f4a45"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d844702198395d3f80222777030f69db6be6b709"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/cd0e707a927a70cdfd8bc5a512a9719a87f5ed51"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/82544d36b1729153c8aeb179e84750f0c085d3b1"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T13:16:28Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.1,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - The flaw is reached only via the local `mmap(2)`/`mprotect(2)` syscalls on a file residing on a stacked filesystem (overlayfs); there is no network-facing path.\nAC:L - A confined process reliably triggers the missing backing-file check on every mmap/mprotect of an overlayfs file; there is no race, timing, or memory-layout condition outside the attacker's control.\nPR:L - Exploitation requires a local, low-privileged (typically SELinux-confined) process; overlayfs is `FS_USERNS_MOUNT`, so even an unprivileged user can set up the overlay and reach these paths.\nUI:N - The attacking process performs mmap/mprotect itself; no action by any other user is needed.\nS:U - Both the vulnerable component (kernel/SELinux LSM) and the impacted resources (files governed by the same kernel/SELinux authority) lie within one security scope; there is no VM/IOMMU/hypervisor boundary crossing.\nC:H - The missing backing-file check bypasses the mounter-credential `FILE__READ` gate, allowing a confined process to mmap and read the full contents of attacker-chosen backing files that SELinux policy was meant to protect.\nI:H - The bypass also defeats `FILE__WRITE`, `FILE__EXECUTE`, `PROCESS__EXECMEM`, and `FILE__EXECMOD` enforcement, letting a confined process modify shared-mapped backing files and execute code/modified content that policy explicitly forbids \u2014 a direct, serious integrity violation.\nA:N - The defect is a missing permission check with no memory corruption, crash, hang, or resource exhaustion; availability is unaffected."
    }
  }
}