CVE-2026-98921 ovl: fix UAF in ovl_do_mkdir() debug print

Not scored Published 23 Oct 2026 Updated 23 Oct 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2026-98921?

CVE-2026-98921 is a vulnerability in Linux, published on 23 Oct 2026.

Official description

In the Linux kernel, the following vulnerability has been resolved:

ovl: fix UAF in ovl_do_mkdir() debug print

ovl_do_mkdir() prints the input dentry with %pd after vfs_mkdir(). Since commit fe497f0759e0 ("VFS: change vfs_mkdir() to unlock on failure."), vfs_mkdir() calls end_creating() on the input dentry on failure and may replace it on success, so the post-call %pd can use-after-free the dentry when CONFIG_OVERLAY_FS_DEBUG is enabled.

Print the dentry before the call and only the result afterward.

Which versions are affected by CVE-2026-98921?

How do I fix CVE-2026-98921?

Upgrade to a fixed version.

Is CVE-2026-98921 being exploited?

There is no known exploitation of CVE-2026-98921 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-98921, GHSA-5m82-wc7w-682w, UBUNTU-CVE-2026-98921.