PT-2026-121958
CVE-2026-98981
·
Published
2026-10-23
·
Updated
2026-10-23
Description by
CVSS 3.1
8.8
HighMetricsAV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
In the Linux kernel, the following vulnerability has been resolved:
namespace: unhash a dentry before detaching the mounts on it
unlink(), rmdir() and rename() remove the entry from the filesystem,
call detach mounts() on the entry with the inode locked and then call
d delete() once the inode is unlocked.
The thing is that between detach mounts() and d delete() the dentry is
still hashed and positive. But after detach mounts() nothing covers the
dentry anymore. A lookup that finds this dentry in the dcache can
uncover what the mounts hid.
That's a problem when unlinking files or directories that are
mountpoints in other mount namespaces. Everybody who had the underlying
entry covered can race the detach mount() call until d delete() has run.
The race window isn't all that small. It encompasses namespace unlock()
with a full synchronize rcu expedited() grace period and the
inode unlock() of the entry.
In my experiments three walkers that kept trying read an overmounted
file in 11938 of the 16140 unlinks that removed its mountpoint from a
bind mount of the filesystem within a minute.
Fun fact, d invalidate() has the same ordering problem but gets it
right. It unhashes the dentry first and detaches the mounts afterwards.
Let's do the same in detach mounts():
-
A lookup that hasn't found the dentry yet misses it in the dcache and waits for the directory lock that the caller holds until the name is gone for good.
-
A lockless lookup that found it already fails the mount lock check while the dentry still counts as a mountpoint and the d seq check once it doesn't, and retries.
This fixes the lockless path. We still need to fix the reference count
lookup in a follow-up patch.
So d drop() the dentry. The dentry stays positive and held but can't be
found anymore. Then proceed with the detach and unlink.
Reproducer:
The reads were counted with the program below, three walkers for 60 s
in a VM with 4 CPUs. The race window is stretched with the debug patch
pasted here. fs.detach race walk us sleeps in lookup fast() once it
found a mountpoint dentry and before its mounts are crossed.
fs.detach race unlink us sleeps in vfs unlink() between detach mounts()
and d delete().
// SPDX-License-Identifier: GPL-2.0
/*
- unlink covered: unlink a file that is a mountpoint in a detached copy of
- its mount, against lookups that open it through that copy.
- A is a tmpfs with the file f1 (content SECRET F) and the plain file
- MARK A. A' is an open tree(OPEN TREE CLONE) copy of A with MARK A bound
- on A'/f1, held through an O PATH fd on its root once the tree fd is
- closed. Walkers open f1 through that fd while the driver unlinks A/f1,
- where nothing is mounted on it. A walker may read MARK A or get ENOENT.
- A read of SECRET F is a hit: the name was found after its mount was
- gone. The lockless walks use openat2(RESOLVE CACHED).
- usage: unlink covered [-t seconds] [-w walkers] */ #ifndef GNU SOURCE #define GNU SOURCE #endif #include <errno.h> #include <fcntl.h> #include <pthread.h> #include <stdatomic.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/mount.h> #include <sys/stat.h> #include <sys/syscall.h> #include <linux/openat2.h>
#ifndef NR open tree
#define NR open tree 428
#endif
#ifndef NR move mount
#define NR move mount 429
#endif
#ifndef NR openat2
#define NR openat2 437
#endif
#ifndef OPEN TREE CLONE
#define OPEN TREE CLONE 1
#endif
#ifndef OPEN TREE CLOEXEC
#define OPEN TREE CLOEXEC O CLOEXEC
#endif
#ifndef MOVE MOUNT F EMPTY PATH
#define MOVE MOUNT F EMPTY PATH 0x00000004
#endif
#define WORK "/tmp/uc"
#define ADIR WORK "/A"
static int duration = 60, nwalkers = 3;
static atomic int stop, writer waiting;
static pthread rwlock t cur lock = PTHREAD RWLOCK INITIALIZER;
static int cur fd = -1; /* the root of A', -1 wh
---truncated---
Found an issue in the description? Have something to add? Feel free to write us 👾