CVE-2026-98553: autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
In the Linux kernel, the following vulnerability has been resolved:
autofs: fix sbi->pipe file reference leak in autofskillsb()
When autofsfillsuper() fails before clearing AUTOFSSBICATATONIC (for example, when findgetpid() fails on an invalid pgrp mount option, or when an fscontext is closed before mounting), deactivatelockedsuper() invokes autofskillsb() -> autofscatatonicmode(sbi).
Because AUTOFSSBICATATONIC is still set in sbi->flags, autofscatatonicmode() returns early without calling fput(sbi->pipe), permanently leaking the pipe struct file reference.
Explicitly release sbi->pipe in autofskillsb() if it is still non-NULL after autofscatatonicmode().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the Linux kernel autofs implementation, update autofs_kill_sb() to explicitly call fput(sbi->pipe) when sbi->pipe is still non-NULL, including when AUTOFS_SBI_CATATONIC remains set.