CVE-2026-77478

Updated fuse-overlayfs package fixes security vulnerabilities

No scoreFix available

fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC). (CVE-2026-52791) Operations on hardlinked lower-layer files resolving to the wrong layer. (CVE-2026-77478)

What each source reports

OSVMGASA-2026-0462 No score

Updated fuse-overlayfs package fixes security vulnerabilities

fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC). (CVE-2026-52791) Operations on hardlinked lower-layer files resolving to the wrong layer. (CVE-2026-77478)

Record: MGASA-2026-0462
Updated: 2026-11-02

OSVopenSUSE-SU-2026:12225-1 No score

fuse-overlayfs-1.18-1.1 on GA media

These are all security issues fixed in the fuse-overlayfs-1.18-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:12225-1
Updated: 2026-11-02

OSVSUSE-SU-2026:24519-1 No score

Security update for fuse-overlayfs

This update for fuse-overlayfs fixes the following issue:

CVE-2026-77478: chmod on a hardlinked lower-layer file is silently dropped in the built image (bsc#1286378).

Record: SUSE-SU-2026:24519-1
Updated: 2026-11-05

OSVSUSE-SU-2026:24603-1 No score

Security update for fuse-overlayfs

This update for fuse-overlayfs fixes the following issue:

CVE-2026-77478: chmod on a hardlinked lower-layer file is silently dropped in the built image (bsc#1286378).

Record: SUSE-SU-2026:24603-1
Updated: 2026-11-09

OSVSUSE-SU-2026:5124-1 No score

Security update for fuse-overlayfs

This update for fuse-overlayfs fixes the following issue:

CVE-2026-77478: chmod on a hardlinked lower-layer file is silently dropped in the built image (bsc#1286378).

Record: SUSE-SU-2026:5124-1
Updated: 2026-11-06

Affected packages

Affected packages
Package	Affected	Fixed
`fuse-overlayfs` Mageia:10 From an advisory covering 2 CVEs	before 1.18-1.mga10	1.18-1.mga10
`fuse-overlayfs` SUSE:Linux Micro 6.2	before 1.15-160000.4.1	1.15-160000.4.1
`fuse-overlayfs` SUSE:Linux Enterprise Server 16.0	before 1.15-160000.4.1	1.15-160000.4.1
`fuse-overlayfs` SUSE:Linux Enterprise Server for SAP applications 16.0	before 1.15-160000.4.1	1.15-160000.4.1
`fuse-overlayfs` SUSE:Linux Enterprise Micro 5.3	before 1.1.2-150100.3.17.1	1.1.2-150100.3.17.1
`fuse-overlayfs` SUSE:Linux Enterprise Micro 5.4	before 1.1.2-150100.3.17.1	1.1.2-150100.3.17.1
`fuse-overlayfs` SUSE:Linux Enterprise Micro 5.5	before 1.1.2-150100.3.17.1	1.1.2-150100.3.17.1
`fuse-overlayfs` SUSE:Linux Enterprise Module for Containers 15 SP7	before 1.1.2-150100.3.17.1	1.1.2-150100.3.17.1
`fuse-overlayfs` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS	before 1.1.2-150100.3.17.1	1.1.2-150100.3.17.1
`fuse-overlayfs` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS	before 1.1.2-150100.3.17.1	1.1.2-150100.3.17.1

Show 10 moreShow less

Affected packages
Package	Affected	Fixed
`fuse-overlayfs` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS	before 1.1.2-150100.3.17.1	1.1.2-150100.3.17.1
`fuse-overlayfs` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS	before 1.1.2-150100.3.17.1	1.1.2-150100.3.17.1
`fuse-overlayfs` SUSE:Linux Enterprise Server 15 SP4-LTSS	before 1.1.2-150100.3.17.1	1.1.2-150100.3.17.1
`fuse-overlayfs` SUSE:Linux Enterprise Server 15 SP5-LTSS	before 1.1.2-150100.3.17.1	1.1.2-150100.3.17.1
`fuse-overlayfs` SUSE:Linux Enterprise Server 15 SP6-LTSS	before 1.1.2-150100.3.17.1	1.1.2-150100.3.17.1
`fuse-overlayfs` SUSE:Linux Enterprise Server for SAP Applications 15 SP4	before 1.1.2-150100.3.17.1	1.1.2-150100.3.17.1
`fuse-overlayfs` SUSE:Linux Enterprise Server for SAP Applications 15 SP5	before 1.1.2-150100.3.17.1	1.1.2-150100.3.17.1
`fuse-overlayfs` SUSE:Linux Enterprise Server for SAP Applications 15 SP6	before 1.1.2-150100.3.17.1	1.1.2-150100.3.17.1
`fuse-overlayfs` SUSE:Enterprise Storage 7.1	before 1.1.2-150100.3.17.1	1.1.2-150100.3.17.1
`fuse-overlayfs` openSUSE:Tumbleweed	before 1.18-1.1	1.18-1.1

History

History
Recorded	Changed	Sources
Nov 9, 2026	affected, aliases, references	OSV
Nov 6, 2026	affected, aliases, references	OSV
Nov 6, 2026	affected
Nov 5, 2026	affected, aliases, facts, references	OSV
Nov 2, 2026	first indexed	OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-77478 is a vulnerability with no CVSS score yet in fuse-overlayfs, published September 29, 2026. No source lists public exploit code. Fixed in fuse-overlayfs 1.15-160000.4.1.

References

Show 5 moreShow less