{"id":"CVE-2026-99180","kind":"vulnerability","aliases":["CVE-2026-99180"],"related":[],"title":"Linux kernel: casefolded filesystem lookups can read a freed Unicode map","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nunicode: free the map after a grace period\n\ngeneric_ci_d_hash() and generic_ci_d_compare() read sb->s_encoding and\ndereference the unicode map while a pathwalk in rcu mode holds nothing\nbut rcu_read_lock(). The filesystems that use them, ext4, f2fs and\ntmpfs, drop the map with utf8_unload() from ->put_super(), which runs\nwhen the last reference to the mount goes away. A lookup that is still\ninside such a filesystem at that point reads a freed map.\n\nWith a pathwalk held up in utf8_casefold_hash() while the last reference\nto a casefolded tmpfs goes away:\n\n  BUG: KASAN: slab-use-after-free in utf8nlookup+0x74c/0x950\n  Read of size 8 at addr ff110001030fe658 by task walker/98\n  Call Trace:\n   <TASK>\n   utf8nlookup+0x74c/0x950\n   utf8byte+0x160/0x1560\n   utf8_casefold_hash+0x167/0x230\n   generic_ci_d_hash+0xdd/0x1c0\n   link_path_walk+0x11ad/0x1d30\n   path_lookupat+0x63/0xb00\n   filename_lookup+0x1f1/0x5b0\n   vfs_statx+0xd7/0x3b0\n  [...]\n  Allocated by task 94:\n   __kmalloc_cache_noprof+0x249/0x560\n   utf8_load+0x4e/0x570\n   shmem_parse_opt_casefold.isra.0+0x92/0x270\n  [...]\n  Freed by task 97:\n   kfree+0x1db/0x5b0\n   shmem_put_super+0x72/0x170\n   generic_shutdown_super+0x14c/0x530\n   kill_anon_super+0x3a/0x60\n   deactivate_locked_super+0x9c/0xf0\n   cleanup_mnt+0x9f/0x130\n\nSo far that has been hard to hit. umount(2) waits for a grace period\nin namespace_unlock() before it drops the mount, so only a mount whose\nlast reference goes away elsewhere, like the close of a file or a chdir\nout of a lazily unmounted directory, can race a walker. So it is\nreachable.\n\nDelay the free until a grace period has passed. The map and the data\ntable it holds a reference to then outlive any pathwalk that found the\nsuperblock before the mount went away. The reference on the data table\nmodule is dropped from the rcu callback as well. utf8-core is built in\nwhenever CONFIG_UNICODE is set, so there is no module exit that would\nhave to wait for the callbacks.\n\nOverlayfs points the s_encoding of an overlay at the map of its first\nlayer without taking a reference of its own. That stays correct. The\nlayer is held by the overlay, so its map is dropped only after the\noverlay is gone.","summary":"When a casefolded ext4, f2fs or tmpfs mount is torn down while a path lookup is still running, the lookup can read the Unicode map after it has been freed. The sources do not say what an attacker can gain beyond a kernel use-after-free crash or memory read.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ext4","f2fs","infrastructure","linux-kernel","self-hosted","tmpfs"],"not_affected_if":["config-unicode-disabled","no-casefold-mounts"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel in the upstream commit referenced by NVD\n- Check whether casefold is enabled on a mount with `lsattr -d <dir>` (the F flag marks casefolded directories) or `tune2fs -l <device> | grep -i casefold` for ext4\n- unknown for a definitive exposure test from the sources","fix":"- Update the Linux kernel to a release that includes the upstream fix (the 'unicode: free the map after a grace period' change), version unknown from the sources\n- Until patched, avoid casefold-enabled ext4, f2fs or tmpfs mounts on shared or untrusted hosts\n- unknown for exact fixed version numbers","status":"open","published_at":"2026-10-28T11:17:38+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","triaged_at":"2026-10-28T11:35:25+00:00","updated_at":"2026-10-28T11:35:25+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T11:35:25Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix (the 'unicode: free the map after a grace period' change), version unknown from the sources\n- Until patched, avoid casefold-enabled ext4, f2fs or tmpfs mounts on shared or untrusted hosts\n- unknown for exact fixed version numbers","reach":"local","title":"Linux kernel: casefolded filesystem lookups can read a freed Unicode map","impact":"medium","summary":"When a casefolded ext4, f2fs or tmpfs mount is torn down while a path lookup is still running, the lookup can read the Unicode map after it has been freed. The sources do not say what an attacker can gain beyond a kernel use-after-free crash or memory read.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","self-hosted","ext4","tmpfs","f2fs"],"confidence":0.6,"needs_auth":"unknown","worst_case":"A racing lookup reads freed kernel memory, possibly crashing the host","analyst_note":"Find the affected and fixed kernel versions and the upstream commit in NVD or kernel.org stable logs; confirm whether the flaw can escalate beyond a crash.","how_to_check":"- Run `uname -r` and compare against the fixed kernel in the upstream commit referenced by NVD\n- Check whether casefold is enabled on a mount with `lsattr -d <dir>` (the F flag marks casefolded directories) or `tune2fs -l <device> | grep -i casefold` for ext4\n- unknown for a definitive exposure test from the sources","needs_analyst":true,"not_affected_if":["no-casefold-mounts","config-unicode-disabled"],"who_is_affected":"Systems running a Linux kernel with CONFIG_UNICODE enabled that mount ext4, f2fs or tmpfs with casefolding (case-insensitive lookups). Systems without casefolded mounts are unlikely to be exposed. The sources do not say which kernel versions are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000787,"input_tokens":4184,"output_tokens":738,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':200C,215C,218C,223C,229C,234C,238C,242C,246C,255C,259C,263C,270C,275C,280C,285C,290C,294C '-2026':13A,16A '-99180':14A,17A '0':262C '2':305C '8':205C '94':251C '97':268C 'addr':207C 'alloc':248C 'anon':283C 'attack':65B 'away':155C,190C,327C,384C 'beyond':68B 'bug':191C 'built':404C 'cach':253C 'call':212C 'callback':397C,424C 'casefold':3A,30B,179C,187C,221C 'chdir':337C 'ci':98C,103C,226C 'cleanup':292C 'close':331C 'compar':105C 'config':407C 'core':402C 'correct':449C 'crash':75B 'cve':12A,15A 'd':99C,104C,227C 'data':365C,389C 'deactiv':287C 'delay':352C 'derefer':111C 'directori':343C 'drop':136C,316C,393C,461C 'elsewher':328C 'encod':109C,429C 'exit':416C 'ext4':18B,31B,132C 'f2fs':19B,32B,133C 'far':297C 'ff110001030fe658':208C 'file':334C 'filenam':240C 'filesystem':4A,128C,164C 'first':438C 'follow':84C 'found':377C 'free':74B,90C,197C,354C 'freed':9A,57B,170C,265C 'gain':67B 'generic':97C,102C,225C,277C 'goe':154C,189C,326C 'gone':467C 'grace':95C,309C,357C 'hard':301C 'hash':100C,180C,222C,228C 'held':175C,453C 'hit':303C 'hold':121C,368C 'host':26B 'infrastructur':20B 'insid':161C 'kasan':192C 'kernel':2A,23B,70B,82C 'kfree':269C 'kill':282C 'kmalloc':252C 'last':149C,183C,324C 'layer':439C,451C 'lazili':341C 'like':329C 'link':231C 'linux':1A,22B,81C 'linux-kernel':21B 'load':258C 'lock':126C,288C 'lookup':5A,42B,47B,157C,241C 'lookupat':237C 'map':11A,52B,92C,114C,138C,171C,362C,435C,459C 'memori':77B 'mnt':293C 'mode':120C 'modul':391C,415C 'mount':35B,153C,318C,322C,382C 'namespac':312C 'noprof':254C 'noth':122C 'outliv':373C 'overlay':432C,456C,465C 'overlayf':425C 'pass':360C 'path':41B,232C,236C 'pathwalk':117C,174C,375C 'period':96C,310C,358C 'point':167C,426C 'put':143C,273C 'race':345C 'rcu':119C,124C,396C 'reachabl':351C 'read':7A,49B,78B,106C,125C,168C,202C 'refer':150C,184C,325C,370C,386C,443C 'resolv':88C 'run':45B,146C 'say':62B 'sb':107C 'self':25B 'self-host':24B 'set':410C 'shmem':272C 'shmem_parse_opt_casefold.isra':261C 'shutdown':278C 'size':204C 'slab':194C 'slab-use-after-fre':193C 'sourc':59B 'statx':245C 'stay':448C 'still':44B,160C 'super':144C,274C,279C,284C,289C 'superblock':379C 'tabl':366C,390C 'take':441C 'task':210C,250C,267C 'tmpfs':27B,34B,135C,188C 'torn':37B 'trace':213C 'umount':304C 'unicod':10A,51B,89C,113C,408C 'unload':141C 'unlock':313C 'unmount':342C 'use':72B,130C,195C 'use-after-fre':71B 'utf8':140C,178C,220C,257C,401C 'utf8-core':400C 'utf8byte':217C 'utf8nlookup':199C,214C 'vfs':244C 'vulner':85C 'wait':306C,421C 'walk':233C 'walker':347C 'walker/98':211C 'well':399C 'went':383C 'whenev':406C 'whose':323C 'without':440C 'would':418C 'x11ad/0x1d30':235C 'x14c/0x530':281C 'x160/0x1560':219C 'x167/0x230':224C 'x1db/0x5b0':271C 'x1f1/0x5b0':243C 'x249/0x560':256C 'x3a/0x60':286C 'x4e/0x570':260C 'x63/0xb00':239C 'x72/0x170':276C 'x74c/0x950':201C,216C 'x92/0x270':264C 'x9c/0xf0':291C 'x9f/0x130':295C 'xd7/0x3b0':247C 'xdd/0x1c0':230C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with CONFIG_UNICODE enabled that mount ext4, f2fs or tmpfs with casefolding (case-insensitive lookups). Systems without casefolded mounts are unlikely to be exposed. The sources do not say which kernel versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:38+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99180","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99180","severity":null,"published_at":"2026-10-28T11:17:38+00:00","modified_at":"2026-10-28T11:17:38+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","fetched_at":"2026-10-28T11:32:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}