CVE-2026-99171

In the Linux kernel, the following vulnerability has been resolved:

ntfs3: free the sbi after a grace period

If the "nocase" mount option ntfs3 uses custom hash and dentry compare functions. Both access ntfs3 superblock private information in rcu pathwalk. ntfs put super() and ntfs3 kill sb() drop the info without any rcu delay. A lookup that's still inside the filesystem when the last reference to the mount is dropped causes a UAF. With a pathwalk held up in ntfs d hash() while the last reference to the mount goes away:

BUG: KASAN: slab-use-after-free in ntfs nls to utf16+0x752/0x940 Read of size 8 at addr ff1100010453c850 by task walker/99 Call Trace: ntfs nls to utf16+0x752/0x940 ntfs d hash+0x22b/0x500 link path walk+0x11ad/0x1d30 path lookupat+0x63/0xb00 filename lookup+0x1f1/0x5b0 vfs statx+0xd7/0x3b0 [...] Allocated by task 95: kmalloc cache noprof+0x249/0x560 ntfs init fs context+0x2db/0x5a0 alloc fs context+0x52e/0xc70 [...] Freed by task 98: kfree+0x1db/0x5b0 deactivate locked super+0x9c/0xf0 cleanup mnt+0x9f/0x130 task work run+0x131/0x250

The bug is currently masked by the grace period in namespace unlock() for umount(2). Keep the necessary information until the filesystem private info is freed and free it with an rcu delay.

ntfs3 free sbi() now runs from an rcu callback and drops the upcase table via ntfs put shared(). So switch s shared lock over to spin lock bh(). Otherwise the callback can deadlock against a task holding the lock on the same cpu.