CVE-2026-98539

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: use d instantiate new() in ntfs create inode() and murder syzbot's "WARNING in do new mount" saga

ntfs create inode() creates a new inode via ntfs new inode(). It hashes it with insert inode locked() and so it's marked as I NEW until unlock new inode().

ntfs 3 calls d instantiate() in between though... Since the dentry was already hashed by the lookup before the create any path walk finds it without touching the parent's i rwsem and so can lock the inode.

If the inode is a directory unlock new inode() calls lockdep annotate inode mutex key() and marks i rwsem with the i mutex dir key class.

That resets the count and the owner of a lock somebody else may already hold by now...

syzbot has been spamming us with the same godforsaken bug

"WARNING in do new mount"

since 2023. I can't take it anymore so I went looking. Afaict, syzbot's executor chdirs into a freshly mounted ntfs3 image, creates a directory and then mounts some pseudofs on it. Everytime the mkdir() takes longer than syzbot waits mount() runs concurrently:

mkdir("./sys") mount(NULL, "./sys", "sysfs") ntfs create inode() d instantiate() user path at() finds the dentry do lock mount() inode lock(inode) namespace lock() unlock new inode() lockdep annotate inode mutex key() init rwsem(&inode->i rwsem) unlock mount() inode unlock(inode)

The mount side then releases a lock that according to the rwsem nobody holds:

DEBUG RWSEMS WARN ON((rwsem owner(sem) != current) && ...): count = 0x0, magic = 0xffff888043a854e8, owner = 0x0, curr 0xffff888000244880, list empty WARNING: CPU: 0 PID: 5346 at kernel/locking/rwsem.c:1368 up write Call Trace: inode unlock include/linux/fs.h:877 [inline] unlock mount fs/namespace.c:2892 [inline] do new mount fc fs/namespace.c:3828 [inline] do new mount+0x777/0xa40 fs/namespace.c:3887

On PREEMPT RT the same thing shows up as

DEBUG LOCKS WARN ON(rt mutex owner(lock) != current) WARNING: kernel/locking/rtmutex common.h:193 at rt mutex slowunlock

The up write() underflows the reset count. A following inode lock() on that directory then never returns. A path walk into the new directory racing with the mkdir() corrupts the lock the same way via inode lock shared() in lookup slow().

Switch to d instantiate new() and drop the trailing unlock new inode(). All error paths bail out before that point with I NEW still set and keep using discard new inode().

May we never see this fscking bug report again.