CVE-2026-72379

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the vfs tmpfile() function where it fails to verify if the caller's fsuid and fsgid map into the filesystem. On an idmapped mount where the idmapping does not cover the caller's IDs, the ->tmpfile() instance initializes the new inode through inode init owner(). This results in mapped fsuid() and mapped fsgid() returning INVALID UID and INVALID GID, causing the temporary file to be owned by (uid t)-1. This behavior differs from other creation paths, such as may o create() and may create dentry(), which use fsuidgid has mapping() to prevent the creation of objects with owners that the filesystem cannot represent. This affects overlayfs and any filesystem that implements ->tmpfile() and sets FS ALLOW IDMAP, including tmpfs, ext4, btrfs, xfs, and f2fs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.