CVE-2026-52791
Description
A flaw was found in fuse-overlayfs, a component used for rootless containers. This vulnerability allows a low-privileged process to retain SUID (Set User ID) and SGID (Set Group ID) permissions on files after they are truncated or opened with the O_TRUNC flag. This can enable a local attacker to manipulate file permissions, potentially leading to privilege escalation within the system.
Statement
Red Hat is aware of this issue affecting fuse-overlayfs, which is used as an optional, non-default storage backend for rootless Podman/Buildah on kernels or configurations where native (kernel) overlayfs support for user namespaces is unavailable. On currently supported Red Hat Enterprise Linux releases (RHEL >= 8.5 / RHEL 9 / RHEL 10), rootless Podman uses native kernel overlayfs by default; fuse-overlayfs is only invoked as a fallback or when explicitly configured via storage.conf's mount_program option, or in nested/unprivileged container scenarios (e.g. rootless Buildah image builds) that lack CAP_SYS_ADMIN. Exploitation additionally requires a pre-existing file in the container's lower image layer that already carries the SUID or SGID bit and is writable by a low-privileged process, an atypical container image configuration. Red Hat rates the overall risk of this issue as reduced relative to a generic worst-case rating given these preconditions; see the private triage comment on this flaw for the full reachability and CVSS analysis.
Mitigation
Avoid configuring fuse-overlayfs as the storage mount_program for rootless Podman/Buildah where native overlayfs support is available (this is not the default on supported RHEL releases). Ensure container images do not ship world- or group-writable files with the SUID or SGID bit set. No other mitigation is available prior to upgrading to fuse-overlayfs >= 1.17.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Red Hat CVSS v3 Score Explanation
Recalculated per JK-approved reachability analysis on CVE-2026-52791: exploitation requires (1) a container image lower layer that already ships a world/group-writable file with SUID/SGID bits set (atypical) AND (2) fuse-overlayfs active as a non-default fallback storage backend (native kernel overlayfs is the default on supported RHEL for rootless Podman/Buildah). AC raised to High for this precondition chain (cf. CVE-2023-0386 precedent, also AC:H/S:U for an overlayfs privilege issue). Direct impact of this flaw is limited to loss of integrity of the SUID/SGID protection attribute on the copied-up file itself (I:H); it does not itself achieve confidentiality or availability impact, and does not itself cross a security scope boundary (S:U) - actual privilege escalation requires a separate, later action to execute the mis-permissioned file.
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Read Application Data; Modify Application Data
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
