A file copy asked the wrong owner if the source was readable

a1e0eb8f55cfe09bb31a202a388babc411292656 (Amir Goldstein). Fixes: 5dae222a5ff0c. No Cc: stable in the message. Cross-filesystem copy ran with the destination overlay mounter’s credentials, so the source read check used the wrong identity. That can deny a copy that should be allowed, or allow a read that should be denied. The patch fixes the allow-that-should-deny case. The deny-that-should-allow case is left as a quirk.

The commit does not say container escape. Later confirm: CVE-2026-68448. Not in 7.1.8. A stable landing is not promised by the commit itself.