Restricted file disclosure via unchecked OverlayFS copy-up

Information disclosure in Linux kernel OverlayFS allows local users to copy and read files denied by normal permissions. The copy-up path opens and copies a lower-layer file without rechecking the caller's read permission, placing its contents in a user-controlled mount. Exploitation requires a usable user namespace and OverlayFS mount; the consequence is disclosure of otherwise unreadable local files.