CVE-2021-46972

What it actually does

Overlayfs fails to release temporary dentries on metacopy lookup errors, causing reference-count leaks that persist until superblock shutdown and trigger dentry-in-use warnings during unmount.

Why it matters to the business

Systems using overlay filesystems may experience gradual resource exhaustion, repeated unmount warnings, and potential filesystem shutdown failures that disrupt container or layered-storage workloads.

How an attack unfolds

An attacker with local access creates an overlay mount and triggers a metacopy origin lookup that returns an error; the kernel omits the dentry put, leaving the object referenced after the mount is torn down.

How to fix it

Apply the upstream overlayfs dentry-put fix (commit resolving the metacopy error path) or update to a maintained kernel branch that includes the correction; rebuild and reboot affected systems.

How to confirm the fix worked

Reproduce the syzkaller-provided test case, verify that unmount no longer emits dentry-leak warnings, and confirm the absence of the umount_check BUG in kernel logs after applying the patch.

Typical attack path

1. Mount an overlay filesystem with metacopy enabled
2. Craft a file layout that causes ovl_lookup to encounter a metacopy error
3. Trigger unmount or superblock shutdown
4. Observe leaked dentries and associated warnings or busy-inode messages

How to detect it

Search kernel logs and dmesg for overlayfs metacopy refusal messages followed by BUG or WARNING entries referencing umount_check, dentry still in use, or busy inodes after unmount.

What your security team should do

• Prioritize kernel updates for any hosts running overlayfs with metacopy
• Audit container runtimes and storage drivers for overlay usage
• Add kernel log monitoring for dentry and umount_check warnings
• Test the fix in staging environments before broad rollout