CVE-2026-98553

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98553", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.356Z", "datePublished": "2026-10-18T15:18:20.728Z", "dateUpdated": "2026-10-19T09:21:36.247Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:21:36.247Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nautofs: fix sbi->pipe file reference leak in autofs_kill_sb()\n\nWhen autofs_fill_super() fails before clearing AUTOFS_SBI_CATATONIC (for\nexample, when find_get_pid() fails on an invalid pgrp mount option, or\nwhen an fs_context is closed before mounting), deactivate_locked_super()\ninvokes autofs_kill_sb() -> autofs_catatonic_mode(sbi).\n\nBecause AUTOFS_SBI_CATATONIC is still set in sbi->flags,\nautofs_catatonic_mode() returns early without calling fput(sbi->pipe),\npermanently leaking the pipe struct file reference.\n\nExplicitly release sbi->pipe in autofs_kill_sb() if it is still non-NULL\nafter autofs_catatonic_mode()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/autofs/inode.c"], "versions": [{"version": "ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7", "lessThan": "3684e2273ba94553af3c5195a46a50214a1a96e3", "status": "affected", "versionType": "git"}, {"version": "ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7", "lessThan": "0662b1ff9b383d5a233d344e4dc518c27a17f7b8", "status": "affected", "versionType": "git"}, {"version": "ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7", "lessThan": "34fa4c1c6e10507dc60e35a82cc9655666946cfd", "status": "affected", "versionType": "git"}, {"version": "ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7", "lessThan": "a58593b501b7be5ad2bc5181bfa8cd4599be257c", "status": "affected", "versionType": "git"}, {"version": "ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7", "lessThan": "f1c57f5b16bbc3571bd479c290996c4d4e1fb931", "status": "affected", "versionType": "git"}, {"version": "ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7", "lessThan": "4bcb371019097d0e357f097902587401c509bbc9", "status": "affected", "versionType": "git"}, {"version": "ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7", "lessThan": "fc4fd0281ac80b5a3c5a2330f688f0f9d2a420b6", "status": "affected", "versionType": "git"}, {"version": "ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7", "lessThan": "aa5e44b29ffe4eaa08cc2237fd65bc2596bc023e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/autofs/inode.c"], "versions": [{"version": "4.18", "status": "affected"}, {"version": "0", "lessThan": "4.18", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3684e2273ba94553af3c5195a46a50214a1a96e3"}, {"url": "https://git.kernel.org/stable/c/0662b1ff9b383d5a233d344e4dc518c27a17f7b8"}, {"url": "https://git.kernel.org/stable/c/34fa4c1c6e10507dc60e35a82cc9655666946cfd"}, {"url": "https://git.kernel.org/stable/c/a58593b501b7be5ad2bc5181bfa8cd4599be257c"}, {"url": "https://git.kernel.org/stable/c/f1c57f5b16bbc3571bd479c290996c4d4e1fb931"}, {"url": "https://git.kernel.org/stable/c/4bcb371019097d0e357f097902587401c509bbc9"}, {"url": "https://git.kernel.org/stable/c/fc4fd0281ac80b5a3c5a2330f688f0f9d2a420b6"}, {"url": "https://git.kernel.org/stable/c/aa5e44b29ffe4eaa08cc2237fd65bc2596bc023e"}], "title": "autofs: fix sbi->pipe file reference leak in autofs_kill_sb()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/autofs/inode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3684e2273ba94553af3c5195a46a50214a1a96e3", "status": "affected", "version": "ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7", "versionType": "git"}, {"lessThan": "0662b1ff9b383d5a233d344e4dc518c27a17f7b8", "status": "affected", "version": "ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7", "versionType": "git"}, {"lessThan": "34fa4c1c6e10507dc60e35a82cc9655666946cfd", "status": "affected", "version": "ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7", "versionType": "git"}, {"lessThan": "a58593b501b7be5ad2bc5181bfa8cd4599be257c", "status": "affected", "version": "ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7", "versionType": "git"}, {"lessThan": "f1c57f5b16bbc3571bd479c290996c4d4e1fb931", "status": "affected", "version": "ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7", "versionType": "git"}, {"lessThan": "4bcb371019097d0e357f097902587401c509bbc9", "status": "affected", "version": "ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7", "versionType": "git"}, {"lessThan": "fc4fd0281ac80b5a3c5a2330f688f0f9d2a420b6", "status": "affected", "version": "ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7", "versionType": "git"}, {"lessThan": "aa5e44b29ffe4eaa08cc2237fd65bc2596bc023e", "status": "affected", "version": "ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/autofs/inode.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.18"}, {"lessThan": "4.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nautofs: fix sbi->pipe file reference leak in autofs_kill_sb()\n\nWhen autofs_fill_super() fails before clearing AUTOFS_SBI_CATATONIC (for\nexample, when find_get_pid() fails on an invalid pgrp mount option, or\nwhen an fs_context is closed before mounting), deactivate_locked_super()\ninvokes autofs_kill_sb() -> autofs_catatonic_mode(sbi).\n\nBecause AUTOFS_SBI_CATATONIC is still set in sbi->flags,\nautofs_catatonic_mode() returns early without calling fput(sbi->pipe),\npermanently leaking the pipe struct file reference.\n\nExplicitly release sbi->pipe in autofs_kill_sb() if it is still non-NULL\nafter autofs_catatonic_mode()."}], "id": "CVE-2026-98553", "lastModified": "2026-10-19T10:19:11.610", "metrics": {}, "published": "2026-10-18T16:17:07.370", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0662b1ff9b383d5a233d344e4dc518c27a17f7b8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/34fa4c1c6e10507dc60e35a82cc9655666946cfd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3684e2273ba94553af3c5195a46a50214a1a96e3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4bcb371019097d0e357f097902587401c509bbc9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a58593b501b7be5ad2bc5181bfa8cd4599be257c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/aa5e44b29ffe4eaa08cc2237fd65bc2596bc023e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f1c57f5b16bbc3571bd479c290996c4d4e1fb931"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fc4fd0281ac80b5a3c5a2330f688f0f9d2a420b6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: autofs: fix sbi->pipe file reference leak in autofs_kill_sb()", "id": "2555016", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555016"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nautofs: fix sbi->pipe file reference leak in autofs_kill_sb()\nWhen autofs_fill_super() fails before clearing AUTOFS_SBI_CATATONIC (for\nexample, when find_get_pid() fails on an invalid pgrp mount option, or\nwhen an fs_context is closed before mounting), deactivate_locked_super()\ninvokes autofs_kill_sb() -> autofs_catatonic_mode(sbi).\nBecause AUTOFS_SBI_CATATONIC is still set in sbi->flags,\nautofs_catatonic_mode() returns early without calling fput(sbi->pipe),\npermanently leaking the pipe struct file reference.\nExplicitly release sbi->pipe in autofs_kill_sb() if it is still non-NULL\nafter autofs_catatonic_mode().", "A flaw was found in the Linux kernel's automount file system (autofs). A local user can trigger this issue by initiating an autofs mount operation that fails during initialization, causing the kernel to fail to release associated pipe file references. Repeated exploitation can permanently leak system resources, ultimately leading to a Denial of Service (DoS)."], "name": "CVE-2026-98553", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98553\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98553\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98553.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7,3684e2273ba94553af3c5195a46a50214a1a96e3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7,0662b1ff9b383d5a233d344e4dc518c27a17f7b8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7,34fa4c1c6e10507dc60e35a82cc9655666946cfd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7,a58593b501b7be5ad2bc5181bfa8cd4599be257c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7,f1c57f5b16bbc3571bd479c290996c4d4e1fb931)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7,4bcb371019097d0e357f097902587401c509bbc9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7,fc4fd0281ac80b5a3c5a2330f688f0f9d2a420b6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7,aa5e44b29ffe4eaa08cc2237fd65bc2596bc023e)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.271,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.222,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc5,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T18:15:15.190057+00:00", "updated": "2026-10-22T22:30:13.432795+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}