CVE-2026-74595

A moderate flaw was found in the Linux kernel's fscrypt subsystem, which is used by Red Hat Enterprise Linux and Red Hat In-Vehicle OS. When setting a file encryption policy, the fscrypt_ioctl_set_policy() function performs its file-ownership check using &nop_mnt_idmap instead of the idmap of the mount on which the ioctl was issued. On idmapped mounts of filesystems that support both fscrypt and idmapped mounts (such as ext4 and f2fs), the caller's fsuid is therefore compared against the unmapped on-disk inode owner rather than the mapped owner. As a result, the real owner of a file can be wrongly denied the ability to set an encryption policy with -EACCES, while an unrelated local user can be wrongly allowed to set an encryption policy on files they do not own, an access-control bypass whose primary impact is availability (files could be encrypted under a policy/key that makes them inaccessible to their owner). Red Hat rated this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) rather than the upstream/CVEORG Important (7.8) because exploitation requires local access to a system specifically configured with idmapped mounts. Red Hat Enterprise Linux 9 and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2 are affected; Red Hat Enterprise Linux 6, 7, and 8 streams are not affected because the vulnerable code is not present. Because of the Moderate severity rating and the specialized configuration required to trigger this flaw, the fix is being deferred to a future maintenance update of the affected streams; the residual risk is that a local user with access to an idmapped mount could set an encryption policy on files they do not own and potentially render those files inaccessible.