# CVE-2026-99181: autofs: ignore notification errors from a replaced pipe


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 28 Oct 2026
- **Updated:** 28 Oct 2026
- **Also known as:** AZL-111344, BELL-CVE-2026-99181, DEBIAN-CVE-2026-99181, GHSA-q48x-cfgc-jf7c, UBUNTU-CVE-2026-99181

## What is CVE-2026-99181?

CVE-2026-99181 is a vulnerability in Linux, published on 28 Oct 2026. 

### Official description

In the Linux kernel, the following vulnerability has been resolved:

autofs: ignore notification errors from a replaced pipe

autofs_notify_daemon() takes a reference to the current notification
pipe under wq_mutex, then drops the mutex before writing the request. The
write can block while the daemon enters catatonic mode and installs a
replacement pipe.

If the old pipe's reader is then closed, the delayed write returns -EPIPE
and the generic error path enters catatonic mode again. That transition
acts on the current superblock state, closes the replacement pipe, and
releases the new daemon generation's wait queues.

Only enter catatonic mode when the pipe which failed is still the current
pipe. Factor the already-locked transition so the identity check and state
change are atomic with respect to another replacement.

This was reproduced on v7.3-rc5-337-gff47652a4b66c in a local QEMU guest.
An unprivileged UID 65534 lookup filled the old packet pipe before a
normal CATATONIC/SETPIPEFD restart. On the unmodified kernel, the new pipe
received HUP and both a pending victim lookup and a later lookup failed
with ENOENT in two out of two fresh-mount runs.

With this change, the new pipe remained active, received an intact
304-byte request, and both victim lookups completed in two out of two
runs. Normal lookup and restart-without-a-blocked-writer controls passed.
No KASAN, oops, refcount, or lock diagnostic was observed. A source
reproducer and complete local logs are available privately on request.

The demonstrated impact is limited to denial of a shared autofs service
during a legitimate daemon restart. No memory corruption, information leak,
privilege escalation, or code execution primitive was observed.

## Which versions are affected by CVE-2026-99181?


## How do I fix CVE-2026-99181?

Upgrade to a fixed version.

## Is CVE-2026-99181 being exploited?

There is no known exploitation of CVE-2026-99181 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-99181 and fix it if it is affected.

What it is: CVE-2026-99181 is a vulnerability in Linux, published on 28 Oct 2026. 
Exploitation: There is no known exploitation of CVE-2026-99181 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-99181/ (Markdown: https://insights.sbomify.com/CVE-2026-99181/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-99181
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-99181
- OSV: https://osv.dev/vulnerability/CVE-2026-99181

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-99181/
Summaries are generated and may contain mistakes; the official description above is the record.