CVE-2026-98980: namei: don't reveal overmounted entries in refwalk
In the Linux kernel, the following vulnerability has been resolved:
namei: don't reveal overmounted entries in refwalk
In rcuwalk the dentry is validated before it is accepted. stepinto() stepinto() rechecks dseq and followmountrcu() rechecks mountlock. An entry that gets unlinked in between causes the lookup to retry and miss.
A refwalk doesn't do this. lookupfast() takes a reference on the hashed dentry and simply accepts it. So an unlink that happens after the reference was taken isn't seen by refwalk. That's fine for a simple file. We just happened to open it before it was unlinked, no problem.
For a mountpoint and specifically a locked mountpoint it very much isn't. The unlink detaches all mounts and then removes the name. Any refwalk that hasn't traversed the mounts yet simply reveals the underlying entry. It's a very narrow window but it can be hit:
reads of a covered file in 60 s, 3 walkers, ~15000 unlinks no widening 27 that step + 200 us 3741
See the appended patch for a more reliable reproducer.
So check the entry after stepinto(). unlink(), rmdir() and rename() mark the dentry with dontmount() before they detach the mounts and remove the dentry.
So a dentry that is marked with DCACHECANTMOUNT and is unhashed by the time its mounts were looked at is a name that was unlinked under the refwalk. DCACHECANTMOUNT is read after the mounts were looked up and it is set before they are detached by detachmounts(). A refwalk that missed the mounts will see DCACHECANTMOUNT.
Plain dunlinked() is fine. A rename takes the dentry off its hash chain but ddrop() leaves dhash.pprev set. So only ddrop() and a rename over the dentry unhash it. The only move that flips ISROOT splices in a disconnected alias. That doesn't have DCACHECANTMOUNT set.
Add the to stepintoslowpath(). ".." and LOOKUPDOWN may legitimately land on an unhashed directory. A refwalk that crossed onto a mount has path.mnt different from nd->path.mnt. A dentry that a filesystem dropped on its own (dinvalidate(), ddrop()) doesn't have the flag set and is treated as before.
// SPDX-License-Identifier: GPL-2.0 / unlinkcovered: unlink a file that is a mountpoint in a detached copy of its mount, against walkers that open it through that copy. A is a tmpfs with the file f1 (content SECRETF) and the plain file MARKA. A' is an opentree(OPENTREECLONE) copy of A with MARKA bound on A'/f1, held through an OPATH fd on its root once the tree fd is closed. Walkers open f1 through that fd while the driver unlinks A/f1, where nothing is mounted on it. A walker may read MARKA or get ENOENT. A read of SECRETF is a hit: the name was found after its mount was gone. The lockless walks use openat2(RESOLVECACHED). usage: unlinkcovered [-t seconds] [-w walkers] / #ifndef GNUSOURCE #define GNUSOURCE #endif #include <errno.h> #include <fcntl.h> #include <pthread.h> #include <stdatomic.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/mount.h> #include <sys/stat.h> #include <sys/syscall.h> #include <linux/openat2.h>
#ifndef NRopentree #define NRopentree 428 #endif #ifndef NRmovemount #define NRmovemount 429 #endif #ifndef NRopenat2 #define NRopenat2 437 #endif #ifndef OPENTREECLONE #define OPENTREECLONE 1 #endif #ifndef OPENTREECLOEXEC #define OPENTREECLOEXEC OCLOEXEC #endif #ifndef MOVEMOUNTFEMPTYPATH #define MOVEMOUNTFEMPTYPATH 0x00000004 #endif
#define WORK "/tmp/uc" #define ADIR WORK "/A"
static int duration = 60, nwalkers = 3; static atomicint stop, writerwaiting; static pthreadrwlockt curlock = PTHREADRWLOCKINITIALIZER; static int curfd = -1; / the root of A', -1 while there is none / static atomiclong nunlink, nwalk, nmark, nenoent, nothe ---truncated---