{"id":"CVE-2026-98921","kind":"vulnerability","aliases":["CVE-2026-98921"],"related":[],"title":"Linux kernel: overlayfs debug print reads freed dentry during mkdir","description":"In the Linux kernel, the following vulnerability has been resolved:\n\novl: fix UAF in ovl_do_mkdir() debug print\n\novl_do_mkdir() prints the input dentry with %pd after vfs_mkdir().\nSince commit fe497f0759e0 (\"VFS: change vfs_mkdir() to unlock on\nfailure.\"), vfs_mkdir() calls end_creating() on the input dentry on\nfailure and may replace it on success, so the post-call %pd can\nuse-after-free the dentry when CONFIG_OVERLAY_FS_DEBUG is enabled.\n\nPrint the dentry before the call and only the result afterward.","summary":"In the Linux kernel's overlay filesystem, a debug print in the mkdir path reads the input dentry after vfs_mkdir() may have released it. This is a use-after-free that only occurs when the kernel is built with CONFIG_OVERLAY_FS_DEBUG enabled.","severity":"unknown","cvss":null,"epss":0.00198,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["containers","linux-kernel","overlayfs","runtime"],"not_affected_if":["default-config","no-overlay-debug"],"how_to_check":"- Check whether the kernel is built with `CONFIG_OVERLAY_FS_DEBUG` (for example `grep CONFIG_OVERLAY_FS_DEBUG /boot/config-$(uname -r)`)\n- Check the running kernel version with `uname -r` and compare it to the fixed kernel in your distribution's advisory","fix":"- Update to a Linux kernel release or distribution kernel package that includes the fix for ovl_do_mkdir() debug print (the sources do not name a specific version)\n- Rebuild without `CONFIG_OVERLAY_FS_DEBUG` if you do not need overlayfs debug output (unknown whether the sources recommend this)","status":"open","published_at":"2026-10-23T13:17:12+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:58:21+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:58:21Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release or distribution kernel package that includes the fix for ovl_do_mkdir() debug print (the sources do not name a specific version)\n- Rebuild without `CONFIG_OVERLAY_FS_DEBUG` if you do not need overlayfs debug output (unknown whether the sources recommend this)","reach":"local","title":"Linux kernel: overlayfs debug print reads freed dentry during mkdir","impact":"high","summary":"In the Linux kernel's overlay filesystem, a debug print in the mkdir path reads the input dentry after vfs_mkdir() may have released it. This is a use-after-free that only occurs when the kernel is built with CONFIG_OVERLAY_FS_DEBUG enabled.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","overlayfs","containers"],"confidence":0.6,"needs_auth":"unknown","worst_case":"unknown; use-after-free in kernel memory may allow crashes or code execution","analyst_note":"Confirm the fixed kernel versions and whether a local unprivileged user can trigger the mkdir path on debug builds; check the NVD entry and the upstream stable commit.","how_to_check":"- Check whether the kernel is built with `CONFIG_OVERLAY_FS_DEBUG` (for example `grep CONFIG_OVERLAY_FS_DEBUG /boot/config-$(uname -r)`)\n- Check the running kernel version with `uname -r` and compare it to the fixed kernel in your distribution's advisory","needs_analyst":true,"not_affected_if":["default-config","no-overlay-debug"],"who_is_affected":"Only kernels built with CONFIG_OVERLAY_FS_DEBUG enabled are exposed, since the bug is in a debug-only print statement. Systems using overlayfs with standard production kernel configs are not affected by this path. Teams running custom debug kernels or development builds should check the config.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000704,"input_tokens":3437,"output_tokens":721,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98921':13A,16A 'afterward':158C 'built':62B 'call':113C,132C,153C 'chang':104C 'commit':101C 'config':64B,142C 'contain':17B 'creat':115C 'cve':11A,14A 'debug':4A,31B,67B,86C,145C 'dentri':8A,40B,94C,119C,140C,150C 'enabl':68B,147C 'end':114C 'failur':110C,121C 'fe497f0759e0':102C 'filesystem':29B 'fix':80C 'follow':74C 'free':54B,138C 'freed':7A 'fs':66B,144C 'input':39B,93C,118C 'kernel':2A,20B,26B,60B,72C 'linux':1A,19B,25B,71C 'linux-kernel':18B 'may':44B,123C 'mkdir':10A,35B,43B,85C,90C,99C,106C,112C 'occur':57B 'overlay':28B,65B,143C 'overlayf':3A,21B 'ovl':79C,83C,88C 'path':36B 'pd':96C,133C 'post':131C 'post-cal':130C 'print':5A,32B,87C,91C,148C 'read':6A,37B 'releas':46B 'replac':124C 'resolv':78C 'result':157C 'runtim':22B 'sinc':100C 'success':127C 'uaf':81C 'unlock':108C 'use':52B,136C 'use-after-fre':51B,135C 'vfs':42B,98C,103C,105C,111C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Only kernels built with CONFIG_OVERLAY_FS_DEBUG enabled are exposed, since the bug is in a debug-only print statement. Systems using overlayfs with standard production kernel configs are not affected by this path. Teams running custom debug kernels or development builds should check the config.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98921","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98921","severity":null,"published_at":"2026-10-23T13:17:12+00:00","modified_at":"2026-10-23T13:17:12+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98921","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98921","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}