Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-29T16:14:46 fuse-overlayfs: fuse-overlayfs: Privilege Escalation Vulnerability via SUID/SGID Bit Preservation 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N CWE-281

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with mode 4777. This issue is fixed in version 1.17.

A flaw was found in fuse-overlayfs, a component used for rootless containers. This vulnerability allows a low-privileged process to retain SUID (Set User ID) and SGID (Set Group ID) permissions on files after they are truncated or opened with the O_TRUNC flag. This can enable a local attacker to manipulate file permissions, potentially leading to privilege escalation within the system.

Red Hat is aware of this issue affecting fuse-overlayfs, which is used as an optional, non-default storage backend for rootless Podman/Buildah on kernels or configurations where native (kernel) overlayfs support for user namespaces is unavailable. On currently supported Red Hat Enterprise Linux releases (RHEL >= 8.5 / RHEL 9 / RHEL 10), rootless Podman uses native kernel overlayfs by default; fuse-overlayfs is only invoked as a fallback or when explicitly configured via storage.conf's mount_program option, or in nested/unprivileged container scenarios (e.g. rootless Buildah image builds) that lack CAP_SYS_ADMIN. Exploitation additionally requires a pre-existing file in the container's lower image layer that already carries the SUID or SGID bit and is writable by a low-privileged process, an atypical container image configuration. Red Hat rates the overall risk of this issue as reduced relative to a generic worst-case rating given these preconditions; see the private triage comment on this flaw for the full reachability and CVSS analysis. Avoid configuring fuse-overlayfs as the storage mount_program for rootless Podman/Buildah where native overlayfs support is available (this is not the default on supported RHEL releases). Ensure container images do not ship world- or group-writable files with the SUID or SGID bit set. No other mitigation is available prior to upgrading to fuse-overlayfs >= 1.17. Red Hat Enterprise Linux 10 Fix deferred fuse-overlayfs Red Hat Enterprise Linux 8 Fix deferred container-tools:rhel8/fuse-overlayfs Red Hat Enterprise Linux 9 Fix deferred fuse-overlayfs Red Hat OpenShift Container Platform 4 Fix deferred fuse-overlayfs Red Hat OpenShift Container Platform 4 Out of support scope rhcos https://www.cve.org/CVERecord?id=CVE-2026-52791 https://nvd.nist.gov/vuln/detail/CVE-2026-52791 https://github.com/containers/fuse-overlayfs/commit/97e0d968a782fc259ebde112db1e9b9ff1ad724f https://github.com/containers/fuse-overlayfs/releases/tag/v1.17 https://github.com/containers/fuse-overlayfs/security/advisories/GHSA-2cc4-p72c-v85h