CVE-2026-98214

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

selinux: recheck intermediate backing files on mprotect()

mprotect() can be used to bypass the SELinux checks that mmap() performs

against the intermediate layers of a stacked filesystem.

mmap() checks every backing layer as the request descends through the

stack. mprotect() only has the lowest backing file in vma->vm_file, so it

rechecks the top-level user and the lowest mounter, but skips the mounters

of every layer in between. With two nested overlayfs mounts and a policy

denying mounter_t -> middle_file_t:file { execute }, a direct

mmap(PROT_EXEC) is denied:

avc: denied { execute } for pid=71 comm="nested_exec"

path="/payload" dev="overlay" ino=9

scontext=user_u:base_r:mounter_t

tcontext=user_u:object_r:middle_file_t tclass=file permissive=0

while mmap(PROT_NONE) followed by mprotect(PROT_EXEC) succeeds.

Preserve each intermediate path, mounter SID and file-description SID in

the backing-fi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References