CVE-2026-98539: fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga
fs/ntfs3: use dinstantiatenew() in ntfscreateinode() and murder syzbot's "WARNING in donewmount" saga
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In fs/ntfs3, update ntfs_create_inode() to use d_instantiate_new() instead of d_instantiate(), and remove the trailing unlock_new_inode() call.
Event History
Frequently Asked Questions
Which deployments are exposed to the described race?
The issue concerns Linux systems using the ntfs3 filesystem. The documented trigger involves creating a directory on a freshly mounted ntfs3 image while a concurrent mount operation targets that new directory.
What conditions are needed to trigger it?
A timing race is required: mkdir() must still be creating the directory when mount() runs against it. The reported reproducer creates a directory and concurrently mounts sysfs on that directory.
How can administrators recognize a likely occurrence?
The report associates this condition with repeated kernel "WARNING in do_new_mount" messages. A warning occurring during concurrent directory creation and mounting on ntfs3 is consistent with the described issue.
Which fixed kernel releases include the correction?
The provided data identifies three stable kernel commit references, but does not state the kernel release versions that contain them. The fix changes ntfs_create_inode() to use d_instantiate_new().