CVE-2026-74595

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

Exploitation requires a local process to open a directory on an idmapped ext4/f2fs filesystem and issue FS_IOC_SET_ENCRYPTION_POLICY via ioctl(); there is no network, adjacent-radio, or physical-device attack path to the vulnerable fscrypt_ioctl_set_policy() check.

AC:LAttack complexity, low

On idmapped mounts the UID mismatch is structural, not random: any local user whose fsuid equals the inode's unmapped on-disk owner can open an empty victim directory, add their own fscrypt key, and trigger the ioctl without races or attacker-uncontrollable memory layout.

PR:LPrivileges required, low

Only basic local user privileges are needed; the attacker must be able to open the target directory and call FS_IOC_ADD_ENCRYPTION_KEY plus FS_IOC_SET_ENCRYPTION_POLICY, with no real-root or init-namespace capability required beyond normal DAC permissions on the path.

UI:NUser interaction, none

Exploitation requires no action by the victim; the attacker alone issues the ioctl on an empty directory they can open, and the authorization bypass occurs entirely within the attacker's own syscall sequence.

S:UScope, unchanged

This is an incorrect inode_owner_or_capable() authorization check in the kernel fscrypt ioctl path on idmapped mounts; impact stays within the same kernel security authority and does not constitute VM escape, hypervisor bypass, or IOMMU boundary crossing.

C:HConfidentiality impact, high

A wrongly authorized attacker can bind a victim's empty directory to an attacker-controlled fscrypt master key, then decrypt any sensitive files the victim later creates there, giving broad read access to victim data rather than a small bounded leak.

I:HIntegrity impact, high

The ioctl persistently modifies filesystem encryption policy and on-disk fscrypt context for a directory the attacker does not own, granting unauthorized control over a critical security property of victim data at rest.

A:HAvailability impact, high

The bug both wrongly denies legitimate directory owners with -EACCES and lets attackers encrypt a victim's empty directory with an attacker-held key, preventing the real owner from using or recovering that directory and its future contents.