Cloudanix VulnDB

CVE-2026-98921

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A debug-only logging mistake in the Linux kernel's overlay file system could cause crashes on certain directory operations, but only when an unusual debug setting is turned on.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free of a dentry object in ovl_do_mkdir() debug logging when CONFIG_OVERLAY_FS_DEBUG is enabled; vfs_mkdir() may replace or free the dentry via end_creating() before the post-call %pd print occurs.

Why it matters to the business

Kernel instability or crashes on systems using overlay filesystem mounts with debug configuration enabled; minimal operational effect for most deployments because the flaw only exists when a non-default debug option is active and carries very low exploitation probability.

How an attack unfolds

An attacker triggers directory creation through overlayfs so that ovl_do_mkdir calls vfs_mkdir; on failure or certain success paths the dentry is freed or replaced, and the subsequent debug print dereferences the now-invalid pointer. No threat actors or ransomware campaigns are associated with this issue.

How to fix it

Apply the upstream fix that moves the dentry print before vfs_mkdir and prints only the result afterward; rebuild or upgrade to a kernel containing this change.

How to confirm the fix worked

Confirm the patched source no longer performs a %pd print on the input dentry after vfs_mkdir in ovl_do_mkdir; verify CONFIG_OVERLAY_FS_DEBUG is disabled or that the kernel version includes the resolution commit.

Typical attack path

  1. Mount an overlay filesystem with CONFIG_OVERLAY_FS_DEBUG enabled
  2. Perform a mkdir operation that reaches ovl_do_mkdir
  3. Force vfs_mkdir to take a failure or dentry-replacement path
  4. Trigger the post-call debug print that accesses the freed dentry

How to detect it

Inspect kernel logs and crash dumps for overlayfs-related use-after-free warnings or oops messages involving dentry objects; no public exploitation artifacts are known.

What your security team should do

  • Disable CONFIG_OVERLAY_FS_DEBUG unless actively debugging overlayfs
  • Update to a patched kernel release at the next maintenance window
  • Monitor EPSS and KEV status for any future change in exploitability

The record

In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl_do_mkdir() debug print ovl_do_mkdir() prints the input dentry with %pd after vfs_mkdir(). Since commit fe497f0759e0 ("VFS: change vfs_mkdir() to unlock on failure."), vfs_mkdir() calls end_creating() on the input dentry on failure and may replace it on success, so the post-call %pd can use-after-free the dentry when CONFIG_OVERLAY_FS_DEBUG is enabled. Print the dentry before the call and only the result afterward.

Affected packages

Ecosystem Package Introduced Fixed