CVE-2026-98981: namespace: unhash a dentry before detaching the mounts on it
In the Linux kernel, the following vulnerability has been resolved:
namespace: unhash a dentry before detaching the mounts on it
unlink(), rmdir() and rename() remove the entry from the filesystem, call detachmounts() on the entry with the inode locked and then call ddelete() once the inode is unlocked.
The thing is that between detachmounts() and ddelete() the dentry is still hashed and positive. But after detachmounts() nothing covers the dentry anymore. A lookup that finds this dentry in the dcache can uncover what the mounts hid.
That's a problem when unlinking files or directories that are mountpoints in other mount namespaces. Everybody who had the underlying entry covered can race the detachmount() call until ddelete() has run.
The race window isn't all that small. It encompasses namespaceunlock() with a full synchronizercuexpedited() grace period and the inodeunlock() of the entry.
In my experiments three walkers that kept trying read an overmounted file in 11938 of the 16140 unlinks that removed its mountpoint from a bind mount of the filesystem within a minute.
Fun fact, dinvalidate() has the same ordering problem but gets it right. It unhashes the dentry first and detaches the mounts afterwards. Let's do the same in detachmounts():
- A lookup that hasn't found the dentry yet misses it in the dcache and waits for the directory lock that the caller holds until the name is gone for good.
- A lockless lookup that found it already fails the mountlock check while the dentry still counts as a mountpoint and the dseq check once it doesn't, and retries.
This fixes the lockless path. We still need to fix the reference count lookup in a follow-up patch.
So ddrop() the dentry. The dentry stays positive and held but can't be found anymore. Then proceed with the detach and unlink.
Reproducer:
The reads were counted with the program below, three walkers for 60 s in a VM with 4 CPUs. The race window is stretched with the debug patch pasted here. fs.detachracewalkus sleeps in lookupfast() once it found a mountpoint dentry and before its mounts are crossed. fs.detachraceunlinkus sleeps in vfsunlink() between detachmounts() and ddelete().
// SPDX-License-Identifier: GPL-2.0 / unlinkcovered: unlink a file that is a mountpoint in a detached copy of its mount, against lookups that open it through that copy. A is a tmpfs with the file f1 (content SECRETF) and the plain file MARKA. A' is an opentree(OPENTREECLONE) copy of A with MARKA bound on A'/f1, held through an OPATH fd on its root once the tree fd is closed. Walkers open f1 through that fd while the driver unlinks A/f1, where nothing is mounted on it. A walker may read MARKA or get ENOENT. A read of SECRETF is a hit: the name was found after its mount was gone. The lockless walks use openat2(RESOLVECACHED). usage: unlinkcovered [-t seconds] [-w walkers] / #ifndef GNUSOURCE #define GNUSOURCE #endif #include <errno.h> #include <fcntl.h> #include <pthread.h> #include <stdatomic.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/mount.h> #include <sys/stat.h> #include <sys/syscall.h> #include <linux/openat2.h>
#ifndef NRopentree #define NRopentree 428 #endif #ifndef NRmovemount #define NRmovemount 429 #endif #ifndef NRopenat2 #define NRopenat2 437 #endif #ifndef OPENTREECLONE #define OPENTREECLONE 1 #endif #ifndef OPENTREECLOEXEC #define OPENTREECLOEXEC OCLOEXEC #endif #ifndef MOVEMOUNTFEMPTYPATH #define MOVEMOUNTFEMPTYPATH 0x00000004 #endif
#define WORK "/tmp/uc" #define ADIR WORK "/A"
static int duration = 60, nwalkers = 3; static atomicint stop, writerwaiting; static pthreadrwlockt curlock = PTHREADRWLOCKINITIALIZER; static int curfd = -1; / the root of A', -1 wh ---truncated---