CVE-2026-68448

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ovl: check access to copy_file_range source with src mounter creds<br /> <br /> Commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices")<br /> allowed filesystems that implement the copy_file_range() f_op to decide<br /> if they want to access cross-sb copy from/to the same fs type.<br /> <br /> The same commit added checks to verify same sb copy for filesystems that<br /> implement -&gt;copy_file_range() and do not support cross-sb copy at the<br /> time, namely, to ceph, fuse and nfs.<br /> <br /> The two remaining fs which implement -&gt;copy_file_range(), cifs and<br /> overlayfs started to support cross-sb copy from this time.<br /> <br /> While overlayfs does support cross-sb copy when the two underlying files<br /> are on the same base fs, the copy operation on the two real files from<br /> two different overalyfs filesystems is performed with the mounter<br /> creds of the destination overlayfs and the read permission access hook<br /> for the source file was called with the wrong creds.<br /> <br /> This could cause either deny of access to copy which would otherwise be<br /> allowed (e.g. with splice) or allow read access to file which would<br /> otherwise be denied.<br /> <br /> Fix the latter case by explicitly verifying read access to source file<br /> with the source overlayfs mounter creds.<br /> <br /> The former case remains a quirk of cross-sb overlayfs copy, but<br /> userspace could fall back to regular copy so no harm done.