CVE-2026-98921: ovl: fix UAF in ovl_do_mkdir() debug print

Published Oct 23, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

ovl: fix UAF in ovldomkdir() debug print

ovldomkdir() prints the input dentry with %pd after vfsmkdir(). Since commit fe497f0759e0 ("VFS: change vfsmkdir() to unlock on failure."), vfsmkdir() calls endcreating() on the input dentry on failure and may replace it on success, so the post-call %pd can use-after-free the dentry when CONFIGOVERLAYFSDEBUG is enabled.

Print the dentry before the call and only the result afterward.

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 23, 2026

CVE Published

via MITRE·12:02 PM

Data Sourced

via MITRE·12:02 PM

Description

Frequently Asked Questions

Which systems are exposed to this issue?

Systems running the Linux kernel with OverlayFS debug support enabled through CONFIG_OVERLAY_FS_DEBUG are exposed to the vulnerable debug-print path. The issue occurs in ovl_do_mkdir() after it calls vfs_mkdir().

What condition triggers the use-after-free?

The condition is triggered when ovl_do_mkdir() logs its input dentry using %pd after vfs_mkdir() returns. vfs_mkdir() may release that dentry on failure or replace it on success, leaving the debug print with a potentially freed dentry.

Is a default kernel configuration affected?

The vulnerable path requires CONFIG_OVERLAY_FS_DEBUG to be enabled. The provided information does not state whether that option is enabled in any particular default distribution or kernel configuration.

What does the fix change?

The fix logs the dentry before calling vfs_mkdir(), then logs only the result after the call. This avoids dereferencing the dentry after vfs_mkdir() may have freed or replaced it.

CVE-2026-98921: ovl: fix UAF in ovl_do_mkdir() debug print

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What condition triggers the use-after-free?

Is a default kernel configuration affected?

What does the fix change?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What condition triggers the use-after-free?

Is a default kernel configuration affected?

What does the fix change?