SB2026080758 - Incorrect default permissions in Linux kernel fs

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect default permissions (CVE-ID: CVE-2026-64596)

CWE-ID: CWE-276 - Incorrect Default Permissions

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper permission enforcement in pseudo filesystem file mappings when mmaping executable pseudo-fs file descriptors. A local user can mmap a pseudo-fs file descriptor with executable permissions to cause a denial of service.

This issue is reproducible on kernels built with CONFIG_DEBUG_VFS=y, where the condition triggers a kernel warning.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/6de2aeffabaafaeda819e60ec8d04f199711e11a
• https://git.kernel.org/stable/c/8e931557b317f0fb414839fa51fae1d5feb0ad97
• https://git.kernel.org/stable/c/b9d45d328fcda4f0d3d281b7d6f12d3f181d9381