Linux kernel mm: mincore/MADV_PAGEOUT ownership checks use the wrong idmap on idmapped mounts

Impact

The ownership check that gates the page-cache side-channel protection in mincore() and madvise(MADV_PAGEOUT) was evaluated against nop_mnt_idmap, so it ignored the mount's idmap entirely. On idmapped mounts, which is how container runtimes and user-namespace pods present shared images and volumes, that check decides against the on-disk owner rather than the translated one, so the policy the kernel enforces is not the policy it intends. Upstream describes the practical effect as usually benign, because the fallback file_permission(MAY_WRITE) does use the correct idmap and normally succeeds; the visible edge case is a mode-0444 file where neither check passes. The record shows no demonstrated cross-tenant page-cache leak, and the issue was found by code inspection rather than in the wild, so treat this as an isolation-semantics correctness fix on multi-tenant nodes, not an urgent one.

Who can reach it

Local unprivileged process calling mincore() or madvise(MADV_PAGEOUT) on a file reached through an idmapped mount, for example a tenant process inside a user-namespaced container. No authentication beyond having a shell or workload on the node.

What to do

Pick up the fixed stable kernel (commits at git.kernel.org) and reboot each node; the change is in mm, so there is no daemon-restart or live-patch path. Given the low practical impact, fold it into the next scheduled kernel rotation rather than a dedicated drain.

References

Related entries

• Linux kernel (drivers/vfio/pci): The disable_idle_d3 power-management flag was a module-wide global that could changeCVE-2026-64476 · Linux kernel (drivers/vfio/pci)Medium
• Linux kernel (drivers/iommu/intel): SVA bind and unbind are asymmetric on VT-d hardware without PCI/PRI - bind skipsCVE-2026-64591 · Linux kernel (drivers/iommu/intel)Medium
• Linux kernel (arch/x86/kvm/vmx): When a nested VM-Enter fails on invalid guest state, KVM took an open-coded exit pathCVE-2026-68081 · Linux kernel (arch/x86/kvm/vmx)Medium
• AMD SEV-ES (CacheWarp): CacheWarp: INVD lets a malicious hypervisor revert SEV-ES guest memory writes, breaking guestCVE-2023-20592 · AMD SEV-ES (CacheWarp)Medium
• Linux kernel (drivers/pci): When the kernel coalesces two adjacent host-bridge apertures it invalidates the absorbedCVE-2023-53814 · Linux kernel (drivers/pci)Medium
• AMD SEV-SNP (BadRAM): BadRAM: improper validation of DIMM SPD metadata lets an attacker with physical access or ring0CVE-2024-21944 · AMD SEV-SNP (BadRAM)Medium