All vulnerabilities
CVE-2026-98921

Linux: ovl: fix UAF in ovl_do_mkdir() debug print

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in719bd33ab359c539a68a278c15a97deb77565cdbFixed versionCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 719bd33ab359c539a68a278c15a97deb77565cdbLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ovl: fix UAF in ovl_do_mkdir() debug print

ovl_do_mkdir() prints the input dentry with %pd after vfs_mkdir(). Since commit fe497f0759e0 ("VFS: change vfs_mkdir() to unlock on failure."), vfs_mkdir() calls end_creating() on the input dentry on failure and may replace it on success, so the post-call %pd can use-after-free the dentry when CONFIG_OVERLAY_FS_DEBUG is enabled.

Print the dentry before the call and only the result afterward.

Text from CVE List

Affected versions 6

  • Linuxaffected: fe497f0759e0efb949f9480911d00b6045c21f50 before 719bd33ab359c539a68a278c15a97deb77565cdbCVE List
  • Linuxaffected: fe497f0759e0efb949f9480911d00b6045c21f50 before ae146bc1abdeb4607abf2975b858c053024e8ac1CVE List
  • Linuxaffected: 6.19CVE List
  • Linuxunaffected: all versions before 6.19CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2