Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-64294

In the Linux kernel, the following vulnerability has been resolved: mm: do file ownership checks with the proper mount idmap Ever since idmapped mounts were introduced, inode ownership checks (for side-channel protection) in mincore() and madvise(MADV_PAGEOUT) were done against the nop_mnt_idmap, which completely ignores the file's mount's idmap. This results in odd edgecases like: 1) mount/bind-mount with an idmap userA:userB:1 2) userB runs an owner_or_capable() check on file that is owned
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:294f7102815c50635c02c2071a217893a3220a166408fd0a82ff9ae0fc50cbda
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["include/linux/fs.h","mm/filemap.c","mm/madvise.c","mm/mincore.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.12"},{"lessThan":"5.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:59ac99c4b5c17786af2e4618c2fe87e86ae13ba0ea17e4f597e40a1072781c23 · sha256:af38e3ce3e07e9c3… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/linux/fs.h","mm/filemap.c","mm/madvise.c","mm/mincore.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"744b23aa430d52f5c8e4dbff7d71496d6643bed2","status":"affected","version":"9caccd41541a6f7d6279928d9f971f6642c361af","versionType":"git"},{"lessThan":"8344bdf0629457e532797b42d9d2bbf2a2900bbf","status":"affected","version":"9caccd41541a6f7d6279928d9f971f6642c361af","versionType":"git"},{"lessThan":"5c942ad7df75925ee166e7f0fb36892d8dde376b","status":"aff…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:59ac99c4b5c17786af2e4618c2fe87e86ae13ba0ea17e4f597e40a1072781c23 · sha256:af38e3ce3e07e9c3… · /containers/cna/affected/0

Affected products and versions

2 source assertions
{"defaultStatus":"affected","product":"Linux","programFiles":["include/linux/fs.h","mm/filemap.c","mm/madvise.c","mm/mincore.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.12"},{"lessThan":"5.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:59ac99c4b5c17786af2e4618c2fe87e86ae13ba0ea17e4f597e40a1072781c23 · sha256:af38e3ce3e07e9c3… · /containers/cna/affected/1
{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/linux/fs.h","mm/filemap.c","mm/madvise.c","mm/mincore.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"744b23aa430d52f5c8e4dbff7d71496d6643bed2","status":"affected","version":"9caccd41541a6f7d6279928d9f971f6642c361af","versionType":"git"},{"lessThan":"8344bdf0629457e532797b42d9d2bbf2a2900bbf","status":"affected","version":"9caccd41541a6f7d6279928d9f971f6642c361af","versionType":"git"},{"lessThan":"5c942ad7df75925ee166e7f0fb36892d8dde376b","status":"aff…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:59ac99c4b5c17786af2e4618c2fe87e86ae13ba0ea17e4f597e40a1072781c23 · sha256:af38e3ce3e07e9c3… · /containers/cna/affected/0

Source references

5 source assertions
{"url":"https://git.kernel.org/stable/c/04ba248d02d9eaa3d9077b00a6134caa75fa3e90"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:59ac99c4b5c17786af2e4618c2fe87e86ae13ba0ea17e4f597e40a1072781c23 · sha256:af38e3ce3e07e9c3… · /containers/cna/references/3
{"url":"https://git.kernel.org/stable/c/5c942ad7df75925ee166e7f0fb36892d8dde376b"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:59ac99c4b5c17786af2e4618c2fe87e86ae13ba0ea17e4f597e40a1072781c23 · sha256:af38e3ce3e07e9c3… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/744b23aa430d52f5c8e4dbff7d71496d6643bed2"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:59ac99c4b5c17786af2e4618c2fe87e86ae13ba0ea17e4f597e40a1072781c23 · sha256:af38e3ce3e07e9c3… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/8344bdf0629457e532797b42d9d2bbf2a2900bbf"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:59ac99c4b5c17786af2e4618c2fe87e86ae13ba0ea17e4f597e40a1072781c23 · sha256:af38e3ce3e07e9c3… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/e187bc02f8fa4226d62814592cf064ee4557c470"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:59ac99c4b5c17786af2e4618c2fe87e86ae13ba0ea17e4f597e40a1072781c23 · sha256:af38e3ce3e07e9c3… · /containers/cna/references/4

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer