CVE-2026-89767

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ovl: fix double end_creating() on the casefold-mismatch path

ovl_create_real() releases the new dentry twice when the casefold

consistency check fails. The S_IFDIR branch calls end_creating() and

sets err, then falls through to the common out: label which calls

end_creating() on the same dentry again:

case S_IFDIR:

newdentry = ovl_do_mkdir(ofs, dir, newdentry, attr->mode);

err = PTR_ERR_OR_ZERO(newdentry);

if (!err && ofs->casefold != ovl_dentry_casefolded(newdentry)) {

pr_warn_ratelimited(...);

end_creating(newdentry); /* first */

err = -EINVAL;

}

break;

...

if (err)

goto out;

...

out:

if (err) {

end_creating(newdentry); /* second, same dentry */

return ERR_PTR(err);

}

end_creating() is end_dirop(), which does inode_unlock() on the parent

and dput() on the dentry, so the parent directory's i_rwsem is unlocked

twice and the dentry is put twice. The second unlock releases a lock

tha

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References