CVE-2026-72379fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid
- —Not scoredno CVSS score yet
- 0.21%Exploitation in 30 daysEPSS · top 88% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid vfs_tmpfile() never checked that the caller's fsuid and fsgid map into the filesystem. On an idmapped mount whose idmapping does not cover the caller's fs{u,g}id, the ->tmpfile() instance initializes the new inode through inode_init_owner(), where mapped_fsuid()/mapped_fsgid() return INVALID_UID/INVALID_GID, and the tmpfile ends up owned by (uid_t)-1. Every other creation path already refuses this: may_o_create() (O_CREAT) and may_create_dentry() (mkdir, mknod, symlink, link) bail out with -EOVERFLOW via fsuidgid_has_mapping() precisely so that an object cannot be created with an owner the filesystem cannot represent. An O_TMPFILE is no exception: it is created I_LINKABLE and linkat(2) can splice it into the namespace afterwards, so the same guarantee must hold. Add the missing fsuidgid_has_mapping() check to vfs_tmpfile(). On a non-idmapped mount the caller's fs{u,g}id always map in the superblock's user namespace, so this is a no-op there and only takes effect on an idmapped mount that does not map the caller. It applies to every filesystem that sets FS_ALLOW_IDMAP and implements ->tmpfile() (tmpfs, ext4, btrfs, xfs, f2fs, ...), and to overlayfs, whose upper-layer tmpfile creation funnels through vfs_tmpfile() via backing_tmpfile_open().
Timeline
ID reserved
By Linux
- 6 days later
· 6 days later
Published
- 3 months later
· 3 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.21% · top 88% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 8e5389132ab429604c1a2459b52f0c849a71cc61 – < 74365c6e367725728d5ce36d38ca116c9f77a254
- affected 8e5389132ab429604c1a2459b52f0c849a71cc61 – < bac8fb0d60254846f3b56957435dcd870ae12948
- affected 8e5389132ab429604c1a2459b52f0c849a71cc61 – < 503d0568a525b168d9aa5ca046ec72fc5477df84
- affected 8e5389132ab429604c1a2459b52f0c849a71cc61 – < a2038514e69371eb493083a6a897ed20fcbb8acb
- affected 8e5389132ab429604c1a2459b52f0c849a71cc61 – < 47e434da476b5a8bcd1e6e52ab03c5ee7764ee78
- affected 8e5389132ab429604c1a2459b52f0c849a71cc61 – < 539dce1144651f7976fa418e618b0b574bf15eeb
- affected 5.13
- unaffected < 5.13
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.145 – ≤ 6.6.*
- unaffected 6.12.97 – ≤ 6.12.*
- unaffected 6.18.40 – ≤ 6.18.*
- unaffected 7.1.5 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References6
- https://git.kernel.org/stable/c/74365c6e367725728d5ce36d38ca116c9f77a254 (opens in a new tab)
- https://git.kernel.org/stable/c/bac8fb0d60254846f3b56957435dcd870ae12948 (opens in a new tab)
- https://git.kernel.org/stable/c/503d0568a525b168d9aa5ca046ec72fc5477df84 (opens in a new tab)
- https://git.kernel.org/stable/c/a2038514e69371eb493083a6a897ed20fcbb8acb (opens in a new tab)
- https://git.kernel.org/stable/c/47e434da476b5a8bcd1e6e52ab03c5ee7764ee78 (opens in a new tab)
- https://git.kernel.org/stable/c/539dce1144651f7976fa418e618b0b574bf15eeb (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-59278 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-72379)Record last updated .