{"id":"CVE-2026-77478","aliases":["MGASA-2026-0462","SUSE-SU-2026:24519-1","SUSE-SU-2026:24603-1","SUSE-SU-2026:5124-1","openSUSE-SU-2026:12225-1"],"status":"published","title":"Updated fuse-overlayfs package fixes security vulnerabilities","description":"fuse-overlayfs release-1.x preserves SUID/SGID bits after\ntruncate/open(O_TRUNC). (CVE-2026-52791)\nOperations on hardlinked lower-layer files resolving to the wrong layer.\n(CVE-2026-77478)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-09-29T19:12:34Z","modified":"2026-11-09T17:23:10Z","fixes":[{"ecosystem":"SUSE:Linux Micro 6.2","package":"fuse-overlayfs","fixed_in":["1.15-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"fuse-overlayfs","fixed_in":["1.15-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"fuse-overlayfs","fixed_in":["1.15-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"fuse-overlayfs","fixed_in":["1.1.2-150100.3.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"fuse-overlayfs","fixed_in":["1.1.2-150100.3.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"fuse-overlayfs","fixed_in":["1.1.2-150100.3.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"fuse-overlayfs","fixed_in":["1.1.2-150100.3.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"fuse-overlayfs","fixed_in":["1.1.2-150100.3.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"fuse-overlayfs","fixed_in":["1.1.2-150100.3.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"fuse-overlayfs","fixed_in":["1.1.2-150100.3.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"fuse-overlayfs","fixed_in":["1.1.2-150100.3.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"fuse-overlayfs","fixed_in":["1.1.2-150100.3.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"fuse-overlayfs","fixed_in":["1.1.2-150100.3.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"fuse-overlayfs","fixed_in":["1.1.2-150100.3.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"fuse-overlayfs","fixed_in":["1.1.2-150100.3.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"fuse-overlayfs","fixed_in":["1.1.2-150100.3.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"fuse-overlayfs","fixed_in":["1.1.2-150100.3.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"fuse-overlayfs","fixed_in":["1.1.2-150100.3.17.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"fuse-overlayfs","fixed_in":["1.18-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:10","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-1.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150100.3.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150100.3.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150100.3.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP7","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150100.3.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150100.3.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150100.3.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150100.3.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150100.3.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150100.3.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150100.3.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150100.3.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150100.3.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150100.3.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150100.3.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150100.3.17.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-1.1"}]}]}],"references":[{"url":"https://advisories.mageia.org/MGASA-2026-0462.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36164","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OHDCW47LEOQXLVH2XJNC3A7VFVELJQ6U/","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/YO4BSFYJPI6ZGUIXZ3AHYYYFEYEM4MFO/","tags":["web"]},{"url":"https://github.com/containers/fuse-overlayfs/releases/tag/v1.17","tags":["web"]},{"url":"https://github.com/containers/fuse-overlayfs/releases/tag/v1.18","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624519-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1286378","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77478","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624603-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265124-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"osv":[{"id":"MGASA-2026-0462","title":"Updated fuse-overlayfs package fixes security vulnerabilities","description":"fuse-overlayfs release-1.x preserves SUID/SGID bits after\ntruncate/open(O_TRUNC). (CVE-2026-52791)\nOperations on hardlinked lower-layer files resolving to the wrong layer.\n(CVE-2026-77478)\n","status":"published","published":"2026-09-29T19:12:34Z","modified":"2026-09-29T19:15:04.664714441Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:12225-1","title":"fuse-overlayfs-1.18-1.1 on GA media","description":"These are all security issues fixed in the fuse-overlayfs-1.18-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-22T00:00:00Z","modified":"2026-10-23T17:23:11.554322854Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2026:24519-1","title":"Security update for fuse-overlayfs","description":"This update for fuse-overlayfs fixes the following issue:\n\n- CVE-2026-77478: chmod on a hardlinked lower-layer file is silently dropped in the built image (bsc#1286378).\n","status":"published","published":"2026-11-02T08:37:55Z","modified":"2026-11-05T17:23:15.485817177Z","updated_at":"2026-11-05T17:55:05.69587Z"},{"id":"SUSE-SU-2026:24603-1","title":"Security update for fuse-overlayfs","description":"This update for fuse-overlayfs fixes the following issue:\n\n- CVE-2026-77478: chmod on a hardlinked lower-layer file is silently dropped in the built image (bsc#1286378).\n","status":"published","published":"2026-11-02T08:37:55Z","modified":"2026-11-09T17:23:10.355888408Z","updated_at":"2026-11-09T17:36:36.959817Z"},{"id":"SUSE-SU-2026:5124-1","title":"Security update for fuse-overlayfs","description":"This update for fuse-overlayfs fixes the following issue:\n\n- CVE-2026-77478: chmod on a hardlinked lower-layer file is silently dropped in the built image (bsc#1286378).\n","status":"published","published":"2026-11-05T18:13:53Z","modified":"2026-11-06T19:15:03.644387577Z","updated_at":"2026-11-06T19:35:46.290134Z"}]}}