HIGH Introduced in 6.18
ovl Casefold DoubleFree
CVE-2026-89767
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.7HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: ovl: fix double end_creating() on the casefold-mismatch path ovl_create_real() releases the new dentry twice when the casefold consistency check fails. The S_IFDIR branch calls end_creating() and sets err, then falls through to the common out: label which calls end_creating() on the same dentry again: case S_IFDIR: newdentry = ovl_do_mkdir(ofs, dir, newdentry, attr->mode); err = PTR_ERR_OR_ZERO(newdentry); if (!err && ofs->casefold != ovl_dentry_casefolded(newdentry)) { pr_warn_ratelimited(...); end_creating(newdentry); /* first */ err = -EINVAL; } break; ... if (err) goto out; ... out: if (err) { end_creating(newdentry); /* second, same dentry */ return ERR_PTR(err); } end_creating() is end_dirop(), which does inode_unlock() on the parent and dput() on the dentry, so the parent directory's i_rwsem is unlocked twice and the dentry is put twice. The second unlock releases a lock that is not held, which is what wedges every later creation under that parent, and the second dput() drops a reference that was never taken. The branch was added by commit dfc7da402ccc ("ovl: Check for casefold consistency when creating new dentries") as a bare dput(), which already released the reference twice; commit fe497f0759e0 ("VFS: change vfs_mkdir() to unlock on failure.") converted both sites to end_creating(), adding the double unlock. This is reachable by an unprivileged user. The casefold consistency of the layers is validated at mount time in ovl_parse_layer(), and again on every lookup in ovl_lookup_single(), but ofs->workdir is the internal "work" subdirectory created inside the user-supplied workdir, and that subdirectory is not re-checked. Marking it casefolded after the mount therefore makes every ovl_create_temp() inherit the wrong state - and that path reaches ovl_create_real() through ovl_start_creating_temp(), which uses start_creating() with a generated name and so never runs the lookup-time check. unshare -Urm mount -t tmpfs -o casefold=utf8-12.1.0 tmpfs mnt mkdir -p mnt/lower/d mnt/upper mnt/work mnt/merged mount -t overlay ovl -o lowerdir=mnt/lower,\ upperdir=mnt/upper,workdir=mnt/work mnt/merged chattr +F mnt/work/work mkdir mnt/merged/d/sub # directory copy-up overlayfs: wrong inherited casefold (work/#5) and the next copy-up blocks forever on the parent's i_rwsem: mkdir D start_creating+0x65/0xb0 ovl_start_creating_temp+0xb0/0xe0 [overlay] ovl_create_temp+0xa3/0x1d0 [overlay] ovl_copy_up_one+0x1f1c/0x21c0 [overlay] ovl_copy_up_flags+0xf5/0x140 [overlay] ovl_create_object+0xb7/0x220 [overlay] ovl_mkdir+0x23/0x40 [overlay] Drop the end_creating() from the branch and let out: own the cleanup, which is what every other error path in this function already does.
02KernelScan AI Analysis
Risk summary
An unprivileged local user can trigger a double-free and double lock-release in the overlayfs directory creation path by exploiting a casefold consistency check error path. The double unlock permanently wedges all subsequent directory creation operations under the affected parent, causing a reliable denial-of-service, while the double dput() creates a kernel heap double-free that may be exploitable for privilege escalation beyond the user namespace boundary.
Vulnerability analysis
When overlayfs creates a new directory and a casefold consistency check fails, the error cleanup is performed twice on the same directory object — once inside the error branch and again at the common exit of the function. This double cleanup releases the parent directory's lock twice: the second release unlocks a lock that is no longer held, permanently blocking all later directory operations under that parent. It also frees the directory object twice; the second free releases a reference that was never taken, corrupting kernel heap memory. The fix removes the redundant cleanup from the error branch so that the common exit path handles cleanup alone, consistent with every other error path in the function. An unprivileged local user can trigger this by creating a user namespace, mounting an overlay filesystem, marking the internal work subdirectory as casefolded after mount — bypassing the existing consistency checks — and then performing a directory copy-up.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.18 | 6.18.51 | 2fa220bc0f84 |
| 7.2 | 6.18 | 7.2.4 | b1aa8ab78a8e |
| mainline | 6.18 | 7.3 | 077ab8985ee2 |