CVE-2026-98921 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
ovl: fix UAF in ovl_do_mkdir() debug print
ovl_do_mkdir() prints the input dentry with %pd after vfs_mkdir(). Since commit fe497f0759e0 ("VFS: change vfs_mkdir() to unlock on failure."), vfs_mkdir() calls end_creating() on the input dentry on failure and may replace it on success, so the post-call %pd can use-after-free the dentry when CONFIG_OVERLAY_FS_DEBUG is enabled.
Print the dentry before the call and only the result afterward.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in the Linux kernel's overlay filesystem implementation represents a classic Use-After-Free (UAF) condition arising from improper handling of object lifecycles during error recovery paths. Specifically, this flaw exists within the ovl_do_mkdir function, which is responsible for creating directories within an overlay mount point. The root cause lies in the sequence of operations performed after invoking the Virtual File System layer's vfs_mkdir routine. Historically, developers assumed that the dentry object passed into the mkdir operation would remain valid and accessible immediately following the call, allowing it to be safely printed for debugging purposes using the %pd format specifier when CONFIG_OVERLAY_FS_DEBUG is enabled. However, this assumption fails under specific failure conditions due to changes in how the VFS layer manages directory creation state.
The technical flaw stems from a behavioral change introduced by commit fe497f0759e0, which modified vfs_mkdir() to unlock and clean up on failure via end_creating(). When vfs_mkdir encounters an error during the directory creation process, it invokes end_creating() on the input dentry. This function call effectively releases references or marks the object for destruction depending on the specific locking context and reference counting state at that moment. Consequently, if mkdir fails, the original dentry pointer becomes dangling. If the debug print statement subsequently attempts to access this memory location via %pd, it triggers a use-after-free condition. Furthermore, even in success cases where vfs_mkdir may replace the input dentry with a new one representing the created directory, relying on the old pointer without verifying its validity or updating references leads to accessing stale data structures that no longer correspond to active kernel objects.
From an operational impact perspective, this vulnerability poses significant risks to system stability and security when debugging features are enabled in production kernels. A use-after-free condition allows for arbitrary memory read and potentially write operations depending on how the freed dentry structure is reused by subsequent allocations. An attacker with local access could exploit this race condition or timing window to crash the kernel, resulting in a denial of service through an oops or panic. More critically, if the freed memory is reallocated for sensitive data structures such as credentials or other security-critical objects, it may lead to privilege escalation vulnerabilities where a lower-privileged user can manipulate higher-level system states by controlling the contents written into the reused memory space before the kernel accesses the dangling pointer during the debug print.
This vulnerability aligns with CWE-416, Use After Free, which describes situations where software continues to use a pointer after it has been freed, leading to unpredictable behavior and potential exploitation. In terms of attack vectors, this falls under ATT&CK technique T1059, Command and Scripting Interpreter, if the UAF leads to code execution, or more broadly within system privilege escalation paths like T1068 Exploitation for Privilege Escalation. The vulnerability is particularly insidious because it requires specific configuration flags (CONFIG_OVERLAY_FS_DEBUG) to be active, which might lead administrators to overlook its existence in hardened environments where debug symbols are typically stripped out or disabled.
Mitigation strategies primarily involve applying the upstream kernel patch that corrects the ordering of operations within ovl_do_mkdir(). The fix ensures that any debugging output related to input parameters is generated before invoking vfs_mkdir, thereby guaranteeing that the dentry pointer remains valid during the print operation. For systems where immediate patching is not feasible, disabling CONFIG_OVERLAY_FS_DEBUG in kernel configuration serves as an effective temporary workaround since it removes the code path triggering the UAF entirely. Additionally, developers should audit other instances of debug printing within filesystem operations to ensure they do not rely on object states that may be invalidated by VFS layer callbacks or error handling routines. Regular updates to the Linux kernel are essential to maintain protection against such low-level memory safety violations inherent in complex subsystems like overlayfs.