Medium [CVE-2026-52791] Privilege Escalation Vulnerability via SUID/SGID Bit Preservation
This medium-severity Red Hat Linux advisory covers CVE-2026-52791 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during open(O_TRUNC) and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with mode 4777.
This issue is fixed in version 1.17. This vulnerability allows a low-privileged process to retain SUID (Set User ID) and SGID (Set Group ID) permissions on files after they are truncated or opened with the O_TRUNC flag.
This can enable a local attacker to manipulate file permissions, potentially leading to privilege escalation within the system.
On currently supported Red Hat Enterprise Linux releases (RHEL >= 8.5 / RHEL 9 / RHEL 10), rootless Podman uses native kernel overlayfs by default; fuse-overlayfs is only invoked as a fallback or when explicitly configured via storage.conf's mount_program option, or in nested/unprivileged container scenarios (e.g. rootless Buildah image builds) that lack CAP_SYS_ADMIN.
Exploitation additionally requires a pre-existing file in the container's lower image layer that already carries the SUID or SGID bit and is writable by a low-privileged process, an atypical container image configuration.
- < 1.17
Official advisory · high-confidence parse· fetched 11 days ago·verify at source
Mitigation checklist
- Avoid configuring fuse-overlayfs as the storage mount_program for rootless Podman/Buildah where native overlayfs support is available (this is not the default on supported RHEL releases). Ensure container images do not ship world- or group-writable files with the SUID or SGID bit set. No other mitigation is available prior to upgrading to fuse-overlayfs >= 1.17.
Official advisory · high-confidence parse· fetched 11 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.