---
id: "CVE-2026-99181"
kind: "vulnerability"
aliases: ["CVE-2026-99181"]
title: "Linux autofs: stale pipe write error can wrongly freeze mounts"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["autofs", "linux", "runtime", "self-hosted"]
not_affected_if: ["no-autofs-mounts"]
published_at: "2026-10-28T11:17:38+00:00"
first_seen_at: "2026-10-28T11:32:36+00:00"
updated_at: "2026-10-28T11:35:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99181", "first_seen_at": "2026-10-28T11:32:36+00:00"}]
---

# Linux autofs: stale pipe write error can wrongly freeze mounts

When the autofs daemon restarts while a lookup write is blocked, a late EPIPE error from the old pipe can put the new daemon generation into catatonic mode. The demonstrated result is failed lookups on a shared autofs mount, denial of service only.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` and compare against the fixed kernel version in the vendor's stable branch (unknown from sources)
- Check whether autofs is in use: `systemctl status autofs` or `mount | grep autofs`

## Fix

- Update the Linux kernel to a release that includes the autofs fix (exact version unknown from sources)

## Timeline

- 2026-10-28T11:32:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99181

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

autofs: ignore notification errors from a replaced pipe

autofs_notify_daemon() takes a reference to the current notification
pipe under wq_mutex, then drops the mutex before writing the request. The
write can block while the daemon enters catatonic mode and installs a
replacement pipe.

If the old pipe's reader is then closed, the delayed write returns -EPIPE
and the generic error path enters catatonic mode again. That transition
acts on the current superblock state, closes the replacement pipe, and
releases the new daemon generation's wait queues.

Only enter catatonic mode when the pipe which failed is still the current
pipe. Factor the already-locked transition so the identity check and state
change are atomic with respect to another replacement.

This was reproduced on v7.3-rc5-337-gff47652a4b66c in a local QEMU guest.
An unprivileged UID 65534 lookup filled the old packet pipe before a
normal CATATONIC/SETPIPEFD restart. On the unmodified kernel, the new pipe
received HUP and both a pending victim lookup and a later lookup failed
with ENOENT in two out of two fresh-mount runs.

With this change, the new pipe remained active, received an intact
304-byte request, and both victim lookups completed in two out of two
runs. Normal lookup and restart-without-a-blocked-writer controls passed.
No KASAN, oops, refcount, or lock diagnostic was observed. A source
reproducer and complete local logs are available privately on request.

The demonstrated impact is limited to denial of a shared autofs service
during a legitimate daemon restart. No memory corruption, information leak,
privilege escalation, or code execution primitive was observed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_