Description
The Linux kernel, as used in Ubuntu 18.04 LTS and Ubuntu 18.10, allows local users to obtain names of files in which they would not normally be able to access via an overlayfs mount inside of a user namespace.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Canonical | Linux kernel, as used in Ubuntu 18.04 LTS and Ubuntu 18.10 | 4.15.0-38.41, 4.18.0-10.11 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | linux | 4.15.0-42.45 | USN-3836-1 |
| Ubuntu 18.04 LTS | linux-aws | 4.15.0-1029.30 | USN-3833-1 |
| Ubuntu 18.04 LTS | linux-azure | 4.15.0-1035.36 | — |
| Ubuntu 18.04 LTS | linux-gcp | 4.15.0-1025.26 | USN-3836-1 |
| Ubuntu 18.04 LTS | linux-kvm | 4.15.0-1027.27 | USN-3836-1 |
| Ubuntu 18.04 LTS | linux-oem | 4.15.0-1028.33 | — |
| Ubuntu 18.04 LTS | linux-raspi2 | 4.15.0-1029.31 | USN-3836-1 |
| Ubuntu 16.04 LTS | linux-azure | 4.15.0-1035.36~16.04.1 | — |
| Ubuntu 16.04 LTS | linux-gcp | 4.15.0-1025.26~16.04.1 | USN-3836-2 |
| Ubuntu 16.04 LTS | linux-hwe | 4.15.0-42.45~16.04.1 | USN-3836-2 |
| Ubuntu 14.04 LTS | linux-azure | 4.15.0-1035.36~14.04.2 | — |
Advisories 3
- USN-3836-1 linux, linux-gcp, linux-kvm, linux-raspi2 vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-3833-1 linux-aws vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-3836-2 linux-hwe, linux-gcp vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
References
- 105752 vdb-entry
- USN-3836-2 vendor-advisory
- USN-3835-1 vendor-advisory
- https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-6559.html
- https://lists.ubuntu.com/archives/kernel-team/2018-October/096172.html
- USN-3833-1 vendor-advisory
- USN-3832-1 vendor-advisory
- https://launchpad.net/bugs/1793458
- USN-3836-1 vendor-advisory