Linux Kernel Vulnerability in libfs Affecting Pseudo Filesystems

CVE-2026-64596

What is CVE-2026-64596?

A vulnerability in the Linux kernel's libfs component affects pseudo filesystems by not setting the SB_I_NOEXEC and SB_I_NODEV flags by default during initialization. This oversight can lead to execution permission checks failing when mmap is attempted on anonymous inodes. The issue is particularly evident when running with CONFIG_DEBUG_VFS enabled, resulting in warnings that may hinder the expected behavior of memory mapping operations, especially for dma-buf backed files. It necessitates careful configuration and potentially impacts applications relying on secure mmap operations.

References