CVE-2026-99084
UnknownSummary
In the Linux kernel, a flaw was fixed in iterate_dir() where the directory's i_rwsem lock was held during readdir even for immutable directories that are never removed. For the nullfs instance directory (shared across mount namespaces and kernel threads), a malicious reader could hold the lock indefinitely, blocking mkdir, lookups, and mounts for other users. A new FOP_IMMUTABLE flag was added to skip the lock for such directories.
Risk Assessment
The vulnerability allows one user of an empty mount namespace to stall all other users sharing the same directory (e.g., the root of the initial mount namespace or kernel threads), causing a denial of service (DoS) by hanging filesystem operations.
Recommendation
Update the Linux kernel to a version containing the fix (introducing the FOP_IMMUTABLE flag and skipping the i_rwsem lock for immutable directories).
Other vulnerabilities in Linux kernel
See all- CVE-2026-99087Unknown
In the Linux kernel, dm-integrity has a NULL pointer dereference when a device with the SB_FLAG_DIRTY_BITMAP flag is activated in 'R' mode. The dm_integrity_resume function attempts to read the journal containing the bitmap, causing a crash. The fix skips writes to the device in 'R' mode during resume.
- CVE-2026-99086Unknown
In the Linux kernel, dm-integrity does not validate the superblock on resume, allowing a user to modify the superblock on the underlying device while the dm-integrity device is suspended. This can cause a mismatch in in-memory structure sizes and an out-of-bounds write past the journal, including a 512-byte write through a NULL pointer. The fix snapshots the validated superblock in the constructor and refuses to resume if the on-disk geometry changed.
- CVE-2026-99085Unknown
A Linux kernel vulnerability was fixed in the sched_ext scheduler that caused a CPU hotplug hang when a dying CPU's tasks remained in the BPF scheduler. Such tasks were still counted on the runqueue, but an inactive CPU no longer called ops.dispatch() and could not pull them back, blocking the hotplug thread and cpu_down() while holding cpu_hotplug_lock. The fix re-enqueues tasks on the offline rq to the local DSQ so balance_push() can move them off.
- CVE-2026-99083Unknown
In the Linux kernel, the ksmbd server has a heap out-of-bounds write in krb5_authenticate(). When SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the out_len calculation omits work->next_smb2_rsp_hdr_off, overstating available buffer space and allowing memcpy() to write the AP-REP blob past response_buf. The fix subtracts this value when computing out_len.
- CVE-2026-99082Unknown
A bug was fixed in the Linux kernel KVM on x86 regarding the per-vCPU MMIO cache. The cache was tagged with a memslot generation, but both the fill and validation paths used kvm_memslots(), which unconditionally selects address space 0 even when the vCPU runs in SMM and uses address space 1. As a result, an SMM memslot update could leave an apparently valid entry from the old SMM address space after the vCPU returns to the normal address space, letting a guest force a KVM_EXIT_MMIO for valid RAM.
- CVE-2026-99080Unknown
In the Linux kernel, clear_inode() has an xarray node leak that can be triggered, among other ways, via madvise. Rather than fixing the leaks where they occur, the fix calls xa_destroy(), which has the side effect of cycling the i_pages lock.
- CVE-2026-99079Unknown
In the Linux kernel, the net/mlx5e driver can release a stale XSK buffer during refill retry on a legacy cyclic RQ. When refill succeeds only partially, a WQE left without a replacement retains its old buffer pointer, which may be allocated to another WQE, leading to freeing a live buffer and double-publishing the same UMEM frame. The fix marks the WQE as released immediately after the driver-side free.
- CVE-2026-99078Unknown
In the Linux kernel, the net/mlx5e driver can release a stale XSK buffer during MPWQE refill retry on a striding RQ. When XSK allocation returns -ENOMEM, actual_wq_head is not advanced and a later NAPI poll may call xsk_buff_free() again through stale pointers after frames return to the XSK pool. The fix sets all skip_release_bitmap bits in the error path of mlx5e_xsk_alloc_rx_mpwqe().
- CVE-2026-99077Unknown
A vulnerability in the Linux kernel's IPv4/UDP handling allowed off-path attackers to conduct a side-channel attack on the FIB nexthop exception (FNHE) cache. Previously, an exception was only created if the UDP packet could be matched to an existing socket, enabling discovery of the ephemeral port used by a connected UDP socket. The fix always creates a FNHE before attempting socket matching.
- CVE-2026-99076Unknown
A vulnerability in the Linux kernel's IPv6/UDP handling allowed off-path attackers to conduct a side-channel attack on the exception cache to discover the ephemeral port used by a connected UDP socket. Previously, an exception was only created if the UDP packet could be matched to an existing socket. The fix always creates an exception before attempting socket matching.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iterate_dir() takes the directory's i_rwsem shared and holds it across ->iterate_shared(). For a directory that never has an entry and is never removed the lock keeps nothing still, it only orders every reader and every writer of that inode behind each other. For the directory of a nullfs instance that matters. The instance of the initial mount namespace is the root of every empty mount namespace and the private instance is the root of every kernel thread, so one inode is shared across users who have nothing else in common. And a reader can hold the lock for as long as it likes: back the getdents() buffer with a mapping of a file on a FUSE mount of your own, let the copy of "." and ".." fault and let the server wait. Queue an exclusive taker behind it, a mkdir() in that directory goes through start_dirop() before the read-only mount is reported, and from then on every lookup that misses the dcache in that directory, every create and every mount on it waits until the server answers. One user of an empty mount namespace stalls all the others. Add FOP_IMMUTABLE for the file operations of a directory that never changes and is never removed and let iterate_dir() skip the lock for it. The flag never changes for a file, ->f_pos is protected by f_pos_lock since directories are FMODE_ATOMIC_POS, IS_DEADDIR can't be set on such a directory and neither touch_atime() nor fsnotify take i_rwsem. Set it on the nullfs directory. The placeholder directories of libfs never have an entry either but their owners remove them, so they keep the lock.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS