CVE-2026-98553

What it actually does

Reference leak of the autofs pipe file struct occurs in autofs_kill_sb when autofs_fill_super fails before AUTOFS_SBI_CATATONIC is cleared, causing autofs_catatonic_mode to return early without fput and leaving a permanent dangling reference.

Why it matters to the business

Repeated failed autofs mount attempts can gradually exhaust kernel file references, leading to resource exhaustion, degraded performance, or eventual system instability over time in environments with frequent autofs activity.

How an attack unfolds

An attacker supplies an invalid pgrp mount option or triggers an fs_context close before mount completion to force autofs_fill_super failure while AUTOFS_SBI_CATATONIC remains set, resulting in the pipe reference leak on subsequent deactivate_locked_super calls.

How to fix it

Apply the kernel patch that adds an explicit fput of sbi->pipe in autofs_kill_sb when the pointer remains non-NULL after autofs_catatonic_mode; rebuild and reboot with the updated kernel.

How to confirm the fix worked

Confirm the fix by inspecting the autofs_kill_sb implementation for the added NULL-checked fput on sbi->pipe; test by reproducing fill_super failure paths and verifying no reference count growth via slabinfo or file descriptor monitoring.

Typical attack path

1. Identify or induce conditions for autofs_fill_super failure (invalid pgrp or premature fs_context close)
2. Trigger repeated autofs mount attempts that hit the failure path
3. Allow autofs_kill_sb to execute without releasing sbi->pipe
4. Accumulate leaked file references until kernel resource limits are impacted

How to detect it

Review kernel logs for repeated autofs_fill_super failures combined with autofs_kill_sb invocations; correlate with increasing pipe or file reference counts via slab or proc monitoring over time.

What your security team should do

• Prioritize patching Linux kernels containing autofs on all systems within the next maintenance window
• Monitor for autofs mount failure logs as an early indicator of potential leak accumulation
• Consider disabling autofs where not required to reduce attack surface