The Linux kernel contains an authorization bypass vulnerability in the fscrypt subsystem that could allow local users to perform unauthorized file system operations.

The fscrypt_ioctl_set_policy function performs an incorrect owner check by using a default mount idmap instead of the specific idmap of the active mount. This allows a local, authenticated user to potentially bypass access controls or be erroneously denied legitimate access to encrypted filesystems.

Successful exploitation of this vulnerability could lead to significant security compromises, including unauthorized modification or access to sensitive encrypted data. While the vulnerability requires local access, the potential for privilege escalation or unauthorized data manipulation in multi-tenant or shared environments justifies the high CVSS score of 7.8.

Immediate Action: Update the Linux kernel to version 5.15.217, 6.1.184, 6.6.152, 6.12.104, or a later stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for repeated -EACCES errors or unusual ioctl calls related to filesystem encryption policies, which may indicate attempted exploitation.

Compensating Controls: Restrict local shell access to untrusted users and enforce strict filesystem permissions to minimize the attack surface until kernel patches can be applied.

Public Exploit Available: Unknown

The severity of this vulnerability necessitates a prompt update to the latest stable kernel versions. Organizations utilizing idmapped mounts within their infrastructure should prioritize testing and deploying these security patches to maintain the integrity of their data encryption and access control mechanisms.