Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98921

ovl: fix UAF in ovl_do_mkdir() debug print

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl_do_mkdir() debug print ovl_do_mkdir() prints the input dentry with %pd after vfs_mkdir(). Since commit fe497f0759e0 ("VFS: change vfs_mkdir() to unlock on failure."), vfs_mkdir() calls end_creating() on the input dentry on failure and may replace it on success, so the post-call %pd can use-after-free the dentry when CONFIG_OVERLAY_FS_DEBUG is enabled. Print the dentry before the call and only the result afterward.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • fe497f0759e0efb949f9480911d00b6045c21f50 to < 719bd33ab359c539a68a278c15a97deb77565cdbaffected
  • fe497f0759e0efb949f9480911d00b6045c21f50 to < ae146bc1abdeb4607abf2975b858c053024e8ac1affected

Linux Linux

Default version status: affected

  • 6.19affected
  • 0 to < 6.19unaffected
  • 7.2.9 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References