CVE-2026-98539

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98539", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.356Z", "datePublished": "2026-10-18T15:18:06.921Z", "dateUpdated": "2026-10-19T09:21:22.671Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:21:22.671Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's \"WARNING in do_new_mount\" saga\n\nntfs_create_inode() creates a new inode via ntfs_new_inode(). It hashes\nit with insert_inode_locked() and so it's marked as I_NEW until\nunlock_new_inode().\n\nntfs 3 calls d_instantiate() in between though... Since the dentry was\nalready hashed by the lookup before the create any path walk finds it\nwithout touching the parent's i_rwsem and so can lock the inode.\n\nIf the inode is a directory unlock_new_inode() calls\nlockdep_annotate_inode_mutex_key() and marks i_rwsem with the\ni_mutex_dir_key class.\n\nThat resets the count and the owner of a lock somebody else may already\nhold by now...\n\nsyzbot has been spamming us with the same godforsaken bug\n\n \"WARNING in do_new_mount\"\n\nsince 2023. I can't take it anymore so I went looking. Afaict, syzbot's\nexecutor chdirs into a freshly mounted ntfs3 image, creates a\ndirectory and then mounts some pseudofs on it. Everytime the mkdir()\ntakes longer than syzbot waits mount() runs concurrently:\n\n mkdir(\"./sys\") mount(NULL, \"./sys\", \"sysfs\")\n ntfs_create_inode()\n d_instantiate()\n user_path_at() finds the dentry\n do_lock_mount()\n inode_lock(inode)\n namespace_lock()\n unlock_new_inode()\n lockdep_annotate_inode_mutex_key()\n init_rwsem(&inode->i_rwsem)\n unlock_mount()\n inode_unlock(inode)\n\nThe mount side then releases a lock that according to the rwsem nobody\nholds:\n\n DEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && ...):\n count = 0x0, magic = 0xffff888043a854e8, owner = 0x0,\n curr 0xffff888000244880, list empty\n WARNING: CPU: 0 PID: 5346 at kernel/locking/rwsem.c:1368 __up_write\n Call Trace:\n inode_unlock include/linux/fs.h:877 [inline]\n unlock_mount fs/namespace.c:2892 [inline]\n do_new_mount_fc fs/namespace.c:3828 [inline]\n do_new_mount+0x777/0xa40 fs/namespace.c:3887\n\nOn PREEMPT_RT the same thing shows up as\n\n DEBUG_LOCKS_WARN_ON(rt_mutex_owner(lock) != current)\n WARNING: kernel/locking/rtmutex_common.h:193 at rt_mutex_slowunlock\n\nThe up_write() underflows the reset count. A following inode_lock() on\nthat directory then never returns. A path walk into the new directory\nracing with the mkdir() corrupts the lock the same way via\ninode_lock_shared() in lookup_slow().\n\nSwitch to d_instantiate_new() and drop the trailing unlock_new_inode().\nAll error paths bail out before that point with I_NEW still set and\nkeep using discard_new_inode().\n\nMay we never see this fscking bug report again."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ntfs3/inode.c"], "versions": [{"version": "82cae269cfa953032fbb8980a7d554d60fb00b17", "lessThan": "6fda7121cb6a8ea6fbd77d0f787f04b8e8b5358e", "status": "affected", "versionType": "git"}, {"version": "82cae269cfa953032fbb8980a7d554d60fb00b17", "lessThan": "37ec7353f4ac495b28284b0fcb0e53d21d1b3f3f", "status": "affected", "versionType": "git"}, {"version": "82cae269cfa953032fbb8980a7d554d60fb00b17", "lessThan": "1ae2a242c15b03470b1b16289298e597bbe3bb29", "status": "affected", "versionType": "git"}, {"version": "82cae269cfa953032fbb8980a7d554d60fb00b17", "lessThan": "1abd643f3783ea8f8e273c18697ff0413aa92dc7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ntfs3/inode.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6fda7121cb6a8ea6fbd77d0f787f04b8e8b5358e"}, {"url": "https://git.kernel.org/stable/c/37ec7353f4ac495b28284b0fcb0e53d21d1b3f3f"}, {"url": "https://git.kernel.org/stable/c/1ae2a242c15b03470b1b16289298e597bbe3bb29"}, {"url": "https://git.kernel.org/stable/c/1abd643f3783ea8f8e273c18697ff0413aa92dc7"}], "title": "fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's \"WARNING in do_new_mount\" saga", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ntfs3/inode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6fda7121cb6a8ea6fbd77d0f787f04b8e8b5358e", "status": "affected", "version": "82cae269cfa953032fbb8980a7d554d60fb00b17", "versionType": "git"}, {"lessThan": "37ec7353f4ac495b28284b0fcb0e53d21d1b3f3f", "status": "affected", "version": "82cae269cfa953032fbb8980a7d554d60fb00b17", "versionType": "git"}, {"lessThan": "1ae2a242c15b03470b1b16289298e597bbe3bb29", "status": "affected", "version": "82cae269cfa953032fbb8980a7d554d60fb00b17", "versionType": "git"}, {"lessThan": "1abd643f3783ea8f8e273c18697ff0413aa92dc7", "status": "affected", "version": "82cae269cfa953032fbb8980a7d554d60fb00b17", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ntfs3/inode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's \"WARNING in do_new_mount\" saga\n\nntfs_create_inode() creates a new inode via ntfs_new_inode(). It hashes\nit with insert_inode_locked() and so it's marked as I_NEW until\nunlock_new_inode().\n\nntfs 3 calls d_instantiate() in between though... Since the dentry was\nalready hashed by the lookup before the create any path walk finds it\nwithout touching the parent's i_rwsem and so can lock the inode.\n\nIf the inode is a directory unlock_new_inode() calls\nlockdep_annotate_inode_mutex_key() and marks i_rwsem with the\ni_mutex_dir_key class.\n\nThat resets the count and the owner of a lock somebody else may already\nhold by now...\n\nsyzbot has been spamming us with the same godforsaken bug\n\n \"WARNING in do_new_mount\"\n\nsince 2023. I can't take it anymore so I went looking. Afaict, syzbot's\nexecutor chdirs into a freshly mounted ntfs3 image, creates a\ndirectory and then mounts some pseudofs on it. Everytime the mkdir()\ntakes longer than syzbot waits mount() runs concurrently:\n\n mkdir(\"./sys\") mount(NULL, \"./sys\", \"sysfs\")\n ntfs_create_inode()\n d_instantiate()\n user_path_at() finds the dentry\n do_lock_mount()\n inode_lock(inode)\n namespace_lock()\n unlock_new_inode()\n lockdep_annotate_inode_mutex_key()\n init_rwsem(&inode->i_rwsem)\n unlock_mount()\n inode_unlock(inode)\n\nThe mount side then releases a lock that according to the rwsem nobody\nholds:\n\n DEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && ...):\n count = 0x0, magic = 0xffff888043a854e8, owner = 0x0,\n curr 0xffff888000244880, list empty\n WARNING: CPU: 0 PID: 5346 at kernel/locking/rwsem.c:1368 __up_write\n Call Trace:\n inode_unlock include/linux/fs.h:877 [inline]\n unlock_mount fs/namespace.c:2892 [inline]\n do_new_mount_fc fs/namespace.c:3828 [inline]\n do_new_mount+0x777/0xa40 fs/namespace.c:3887\n\nOn PREEMPT_RT the same thing shows up as\n\n DEBUG_LOCKS_WARN_ON(rt_mutex_owner(lock) != current)\n WARNING: kernel/locking/rtmutex_common.h:193 at rt_mutex_slowunlock\n\nThe up_write() underflows the reset count. A following inode_lock() on\nthat directory then never returns. A path walk into the new directory\nracing with the mkdir() corrupts the lock the same way via\ninode_lock_shared() in lookup_slow().\n\nSwitch to d_instantiate_new() and drop the trailing unlock_new_inode().\nAll error paths bail out before that point with I_NEW still set and\nkeep using discard_new_inode().\n\nMay we never see this fscking bug report again."}], "id": "CVE-2026-98539", "lastModified": "2026-10-19T10:19:09.680", "metrics": {}, "published": "2026-10-18T16:17:05.733", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1abd643f3783ea8f8e273c18697ff0413aa92dc7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1ae2a242c15b03470b1b16289298e597bbe3bb29"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/37ec7353f4ac495b28284b0fcb0e53d21d1b3f3f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6fda7121cb6a8ea6fbd77d0f787f04b8e8b5358e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's \"WARNING in do_new_mount\" saga", "id": "2555026", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555026"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-366", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nfs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's \"WARNING in do_new_mount\" saga\nntfs_create_inode() creates a new inode via ntfs_new_inode(). It hashes\nit with insert_inode_locked() and so it's marked as I_NEW until\nunlock_new_inode().\nntfs 3 calls d_instantiate() in between though... Since the dentry was\nalready hashed by the lookup before the create any path walk finds it\nwithout touching the parent's i_rwsem and so can lock the inode.\nIf the inode is a directory unlock_new_inode() calls\nlockdep_annotate_inode_mutex_key() and marks i_rwsem with the\ni_mutex_dir_key class.\nThat resets the count and the owner of a lock somebody else may already\nhold by now...\nsyzbot has been spamming us with the same godforsaken bug\n\"WARNING in do_new_mount\"\nsince 2023. I can't take it anymore so I went looking. Afaict, syzbot's\nexecutor chdirs into a freshly mounted ntfs3 image, creates a\ndirectory and then mounts some pseudofs on it. Everytime the mkdir()\ntakes longer than syzbot waits mount() runs concurrently:\nmkdir(\"./sys\") mount(NULL, \"./sys\", \"sysfs\")\nntfs_create_inode()\nd_instantiate()\nuser_path_at() finds the dentry\ndo_lock_mount()\ninode_lock(inode)\nnamespace_lock()\nunlock_new_inode()\nlockdep_annotate_inode_mutex_key()\ninit_rwsem(&inode->i_rwsem)\nunlock_mount()\ninode_unlock(inode)\nThe mount side then releases a lock that according to the rwsem nobody\nholds:\nDEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && ...):\ncount = 0x0, magic = 0xffff888043a854e8, owner = 0x0,\ncurr 0xffff888000244880, list empty\nWARNING: CPU: 0 PID: 5346 at kernel/locking/rwsem.c:1368 __up_write\nCall Trace:\ninode_unlock include/linux/fs.h:877 [inline]\nunlock_mount fs/namespace.c:2892 [inline]\ndo_new_mount_fc fs/namespace.c:3828 [inline]\ndo_new_mount+0x777/0xa40 fs/namespace.c:3887\nOn PREEMPT_RT the same thing shows up as\nDEBUG_LOCKS_WARN_ON(rt_mutex_owner(lock) != current)\nWARNING: kernel/locking/rtmutex_common.h:193 at rt_mutex_slowunlock\nThe up_write() underflows the reset count. A following inode_lock() on\nthat directory then never returns. A path walk into the new directory\nracing with the mkdir() corrupts the lock the same way via\ninode_lock_shared() in lookup_slow().\nSwitch to d_instantiate_new() and drop the trailing unlock_new_inode().\nAll error paths bail out before that point with I_NEW still set and\nkeep using discard_new_inode().\nMay we never see this fscking bug report again.", "A flaw was found in the Linux kernel's NTFS3 file system driver. A race condition during directory creation allows concurrent path lookup or mount operations to access and lock an inode before its initialization finishes. This improper synchronization resets and corrupts the directory's internal lock state, causing subsequent operations on the directory to hang indefinitely. A local user could exploit this flaw to cause a Denial of Service (DoS) by triggering concurrent file operations on an NTFS3 file system."], "name": "CVE-2026-98539", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98539\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98539\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98539.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82cae269cfa953032fbb8980a7d554d60fb00b17,6fda7121cb6a8ea6fbd77d0f787f04b8e8b5358e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82cae269cfa953032fbb8980a7d554d60fb00b17,37ec7353f4ac495b28284b0fcb0e53d21d1b3f3f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82cae269cfa953032fbb8980a7d554d60fb00b17,1ae2a242c15b03470b1b16289298e597bbe3bb29)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82cae269cfa953032fbb8980a7d554d60fb00b17,1abd643f3783ea8f8e273c18697ff0413aa92dc7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-19T00:15:14.331167+00:00", "updated": "2026-10-22T22:30:13.444446+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}