Live › vulnerability › CVE-2026-98921
Go to dashboardIn the Linux kernel's overlay filesystem, a debug print in the mkdir path reads the input dentry after vfs_mkdir() may have released it. This is a use-after-free that only occurs when the kernel is built with CONFIG_OVERLAY_FS_DEBUG enabled.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only kernels built with CONFIG_OVERLAY_FS_DEBUG enabled are exposed, since the bug is in a debug-only print statement. Systems using overlayfs with standard production kernel configs are not affected by this path. Teams running custom debug kernels or development builds should check the config.
No product ranges from the sources yet.
CONFIG_OVERLAY_FS_DEBUG (for example grep CONFIG_OVERLAY_FS_DEBUG /boot/config-$(uname -r))uname -r and compare it to the fixed kernel in your distribution's advisoryCONFIG_OVERLAY_FS_DEBUG if you do not need overlayfs debug output (unknown whether the sources recommend this)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
ovl: fix UAF in ovl_do_mkdir() debug print
ovl_do_mkdir() prints the input dentry with %pd after vfs_mkdir(). Since commit fe497f0759e0 ("VFS: change vfs_mkdir() to unlock on failure."), vfs_mkdir() calls end_creating() on the input dentry on failure and may replace it on success, so the post-call %pd can use-after-free the dentry when CONFIG_OVERLAY_FS_DEBUG is enabled.
Print the dentry before the call and only the result afterward.
This page as .md · .json · in your agent: get_signal("CVE-2026-98921")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.