CVE-2026-99180

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99180", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.399Z", "datePublished": "2026-10-28T10:35:33.578Z", "dateUpdated": "2026-10-31T12:44:50.381Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-31T12:44:50.381Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nunicode: free the map after a grace period\n\ngeneric_ci_d_hash() and generic_ci_d_compare() read sb->s_encoding and\ndereference the unicode map while a pathwalk in rcu mode holds nothing\nbut rcu_read_lock(). The filesystems that use them, ext4, f2fs and\ntmpfs, drop the map with utf8_unload() from ->put_super(), which runs\nwhen the last reference to the mount goes away. A lookup that is still\ninside such a filesystem at that point reads a freed map.\n\nWith a pathwalk held up in utf8_casefold_hash() while the last reference\nto a casefolded tmpfs goes away:\n\n BUG: KASAN: slab-use-after-free in utf8nlookup+0x74c/0x950\n Read of size 8 at addr ff110001030fe658 by task walker/98\n Call Trace:\n <TASK>\n utf8nlookup+0x74c/0x950\n utf8byte+0x160/0x1560\n utf8_casefold_hash+0x167/0x230\n generic_ci_d_hash+0xdd/0x1c0\n link_path_walk+0x11ad/0x1d30\n path_lookupat+0x63/0xb00\n filename_lookup+0x1f1/0x5b0\n vfs_statx+0xd7/0x3b0\n [...]\n Allocated by task 94:\n __kmalloc_cache_noprof+0x249/0x560\n utf8_load+0x4e/0x570\n shmem_parse_opt_casefold.isra.0+0x92/0x270\n [...]\n Freed by task 97:\n kfree+0x1db/0x5b0\n shmem_put_super+0x72/0x170\n generic_shutdown_super+0x14c/0x530\n kill_anon_super+0x3a/0x60\n deactivate_locked_super+0x9c/0xf0\n cleanup_mnt+0x9f/0x130\n\nSo far that has been hard to hit. umount(2) waits for a grace period\nin namespace_unlock() before it drops the mount, so only a mount whose\nlast reference goes away elsewhere, like the close of a file or a chdir\nout of a lazily unmounted directory, can race a walker. So it is\nreachable.\n\nDelay the free until a grace period has passed. The map and the data\ntable it holds a reference to then outlive any pathwalk that found the\nsuperblock before the mount went away. The reference on the data table\nmodule is dropped from the rcu callback as well. utf8-core is built in\nwhenever CONFIG_UNICODE is set, so there is no module exit that would\nhave to wait for the callbacks.\n\nOverlayfs points the s_encoding of an overlay at the map of its first\nlayer without taking a reference of its own. That stays correct. The\nlayer is held by the overlay, so its map is dropped only after the\noverlay is gone."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Local statx() pathwalks reach generic_ci_d_hash() and utf8_casefold_hash(), while chdir() and final mount teardown reach shmem_put_super() and the patched utf8_unload(); no network protocol carries the trigger.\nAC:L - After umount2(MNT_DETACH), one attacker can loop Unicode statx() lookups from a retained cwd while a sibling chdir() drops the final mount reference; the attacker controls both sides and can repeatedly retry the race.\nPR:L - shmem_fs_type includes FS_USERNS_MOUNT, so an unprivileged user can mount casefolded tmpfs in their own user/mount namespace and, as inode owner, pass vfs_fileattr_set() to set FS_CASEFOLD_FL.\nUI:N - The same attacker performs the casefolded tmpfs mount, FS_IOC_SETFLAGS, lazy unmount, statx(), and chdir() operations; no victim action is required.\nS:U - The utf8nlookup() use-after-free occurs within the host kernel reached by the local process, and any resulting kernel compromise remains under that same security authority.\nC:H - utf8nlookup() dereferences reclaimed unicode_map tables and ntab[] pointers, including tables->utf8data and utf8agetab; reclaiming the generic-kmalloc object can turn these stale pointer dereferences into attacker-directed kernel reads.\nI:H - utf8_unload() frees a still-referenced generic-kmalloc unicode_map; attacker-controlled heap reclamation can replace its tables and ntab[] pointers used by utf8nlookup(), making this heap use-after-free exploitable for memory corruption and control-flow hijacking.\nA:H - The demonstrated stale unicode_map dereference in utf8nlookup() produces a KASAN slab-use-after-free, and corrupted tables or ntab[] pointers can cause a kernel oops or panic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/unicode/utf8-core.c", "include/linux/unicode.h"], "versions": [{"version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7", "lessThan": "092e14e1479a39157ca01668d43e4649793f39ed", "status": "affected", "versionType": "git"}, {"version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7", "lessThan": "6472455f2b015cad43adb790cb63fe1d3cff2f57", "status": "affected", "versionType": "git"}, {"version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7", "lessThan": "f96c2731a105d6663c606388f5dc21781e00ade5", "status": "affected", "versionType": "git"}, {"version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7", "lessThan": "5d7687b0b71601cc32f1bfd62f56cf5eea3e5a07", "status": "affected", "versionType": "git"}, {"version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7", "lessThan": "69a0d6b31d05e856c7335509222f25321e3c69ca", "status": "affected", "versionType": "git"}, {"version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7", "lessThan": "2b54d3c971a1e5df3c9b0bcc10311ae6c29e79d8", "status": "affected", "versionType": "git"}, {"version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7", "lessThan": "6560c3d9a6925e3747d9ad8463e16010c31ba715", "status": "affected", "versionType": "git"}, {"version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7", "lessThan": "a96c5299bd7305eb984377681eb3222a57376405", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/unicode/utf8-core.c", "include/linux/unicode.h"], "versions": [{"version": "5.2", "status": "affected"}, {"version": "0", "lessThan": "5.2", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.161", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.59", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.6.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "6.18.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.2", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/092e14e1479a39157ca01668d43e4649793f39ed"}, {"url": "https://git.kernel.org/stable/c/6472455f2b015cad43adb790cb63fe1d3cff2f57"}, {"url": "https://git.kernel.org/stable/c/f96c2731a105d6663c606388f5dc21781e00ade5"}, {"url": "https://git.kernel.org/stable/c/5d7687b0b71601cc32f1bfd62f56cf5eea3e5a07"}, {"url": "https://git.kernel.org/stable/c/69a0d6b31d05e856c7335509222f25321e3c69ca"}, {"url": "https://git.kernel.org/stable/c/2b54d3c971a1e5df3c9b0bcc10311ae6c29e79d8"}, {"url": "https://git.kernel.org/stable/c/6560c3d9a6925e3747d9ad8463e16010c31ba715"}, {"url": "https://git.kernel.org/stable/c/a96c5299bd7305eb984377681eb3222a57376405"}], "title": "unicode: free the map after a grace period", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/unicode/utf8-core.c", "include/linux/unicode.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "092e14e1479a39157ca01668d43e4649793f39ed", "status": "affected", "version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7", "versionType": "git"}, {"lessThan": "6472455f2b015cad43adb790cb63fe1d3cff2f57", "status": "affected", "version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7", "versionType": "git"}, {"lessThan": "f96c2731a105d6663c606388f5dc21781e00ade5", "status": "affected", "version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7", "versionType": "git"}, {"lessThan": "5d7687b0b71601cc32f1bfd62f56cf5eea3e5a07", "status": "affected", "version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7", "versionType": "git"}, {"lessThan": "69a0d6b31d05e856c7335509222f25321e3c69ca", "status": "affected", "version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7", "versionType": "git"}, {"lessThan": "2b54d3c971a1e5df3c9b0bcc10311ae6c29e79d8", "status": "affected", "version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7", "versionType": "git"}, {"lessThan": "6560c3d9a6925e3747d9ad8463e16010c31ba715", "status": "affected", "version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7", "versionType": "git"}, {"lessThan": "a96c5299bd7305eb984377681eb3222a57376405", "status": "affected", "version": "b886ee3e778ec2ad43e276fd378ab492cf6819b7", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/unicode/utf8-core.c", "include/linux/unicode.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.2"}, {"lessThan": "5.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.161", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.59", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nunicode: free the map after a grace period\n\ngeneric_ci_d_hash() and generic_ci_d_compare() read sb->s_encoding and\ndereference the unicode map while a pathwalk in rcu mode holds nothing\nbut rcu_read_lock(). The filesystems that use them, ext4, f2fs and\ntmpfs, drop the map with utf8_unload() from ->put_super(), which runs\nwhen the last reference to the mount goes away. A lookup that is still\ninside such a filesystem at that point reads a freed map.\n\nWith a pathwalk held up in utf8_casefold_hash() while the last reference\nto a casefolded tmpfs goes away:\n\n BUG: KASAN: slab-use-after-free in utf8nlookup+0x74c/0x950\n Read of size 8 at addr ff110001030fe658 by task walker/98\n Call Trace:\n <TASK>\n utf8nlookup+0x74c/0x950\n utf8byte+0x160/0x1560\n utf8_casefold_hash+0x167/0x230\n generic_ci_d_hash+0xdd/0x1c0\n link_path_walk+0x11ad/0x1d30\n path_lookupat+0x63/0xb00\n filename_lookup+0x1f1/0x5b0\n vfs_statx+0xd7/0x3b0\n [...]\n Allocated by task 94:\n __kmalloc_cache_noprof+0x249/0x560\n utf8_load+0x4e/0x570\n shmem_parse_opt_casefold.isra.0+0x92/0x270\n [...]\n Freed by task 97:\n kfree+0x1db/0x5b0\n shmem_put_super+0x72/0x170\n generic_shutdown_super+0x14c/0x530\n kill_anon_super+0x3a/0x60\n deactivate_locked_super+0x9c/0xf0\n cleanup_mnt+0x9f/0x130\n\nSo far that has been hard to hit. umount(2) waits for a grace period\nin namespace_unlock() before it drops the mount, so only a mount whose\nlast reference goes away elsewhere, like the close of a file or a chdir\nout of a lazily unmounted directory, can race a walker. So it is\nreachable.\n\nDelay the free until a grace period has passed. The map and the data\ntable it holds a reference to then outlive any pathwalk that found the\nsuperblock before the mount went away. The reference on the data table\nmodule is dropped from the rcu callback as well. utf8-core is built in\nwhenever CONFIG_UNICODE is set, so there is no module exit that would\nhave to wait for the callbacks.\n\nOverlayfs points the s_encoding of an overlay at the map of its first\nlayer without taking a reference of its own. That stays correct. The\nlayer is held by the overlay, so its map is dropped only after the\noverlay is gone."}], "id": "CVE-2026-99180", "lastModified": "2026-10-31T13:17:58.987", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-28T11:17:38.753", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/092e14e1479a39157ca01668d43e4649793f39ed"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2b54d3c971a1e5df3c9b0bcc10311ae6c29e79d8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5d7687b0b71601cc32f1bfd62f56cf5eea3e5a07"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6472455f2b015cad43adb790cb63fe1d3cff2f57"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6560c3d9a6925e3747d9ad8463e16010c31ba715"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/69a0d6b31d05e856c7335509222f25321e3c69ca"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a96c5299bd7305eb984377681eb3222a57376405"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f96c2731a105d6663c606388f5dc21781e00ade5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via use-after-free in Unicode subsystem", "id": "2562645", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562645"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nunicode: free the map after a grace period\ngeneric_ci_d_hash() and generic_ci_d_compare() read sb->s_encoding and\ndereference the unicode map while a pathwalk in rcu mode holds nothing\nbut rcu_read_lock(). The filesystems that use them, ext4, f2fs and\ntmpfs, drop the map with utf8_unload() from ->put_super(), which runs\nwhen the last reference to the mount goes away. A lookup that is still\ninside such a filesystem at that point reads a freed map.\nWith a pathwalk held up in utf8_casefold_hash() while the last reference\nto a casefolded tmpfs goes away:\nBUG: KASAN: slab-use-after-free in utf8nlookup+0x74c/0x950\nRead of size 8 at addr ff110001030fe658 by task walker/98\nCall Trace:\n<TASK>\nutf8nlookup+0x74c/0x950\nutf8byte+0x160/0x1560\nutf8_casefold_hash+0x167/0x230\ngeneric_ci_d_hash+0xdd/0x1c0\nlink_path_walk+0x11ad/0x1d30\npath_lookupat+0x63/0xb00\nfilename_lookup+0x1f1/0x5b0\nvfs_statx+0xd7/0x3b0\n[...]\nAllocated by task 94:\n__kmalloc_cache_noprof+0x249/0x560\nutf8_load+0x4e/0x570\nshmem_parse_opt_casefold.isra.0+0x92/0x270\n[...]\nFreed by task 97:\nkfree+0x1db/0x5b0\nshmem_put_super+0x72/0x170\ngeneric_shutdown_super+0x14c/0x530\nkill_anon_super+0x3a/0x60\ndeactivate_locked_super+0x9c/0xf0\ncleanup_mnt+0x9f/0x130\nSo far that has been hard to hit. umount(2) waits for a grace period\nin namespace_unlock() before it drops the mount, so only a mount whose\nlast reference goes away elsewhere, like the close of a file or a chdir\nout of a lazily unmounted directory, can race a walker. So it is\nreachable.\nDelay the free until a grace period has passed. The map and the data\ntable it holds a reference to then outlive any pathwalk that found the\nsuperblock before the mount went away. The reference on the data table\nmodule is dropped from the rcu callback as well. utf8-core is built in\nwhenever CONFIG_UNICODE is set, so there is no module exit that would\nhave to wait for the callbacks.\nOverlayfs points the s_encoding of an overlay at the map of its first\nlayer without taking a reference of its own. That stays correct. The\nlayer is held by the overlay, so its map is dropped only after the\noverlay is gone.", "A flaw was found in the Linux kernel's Unicode subsystem. This issue occurs because character mapping tables used for case-insensitive file lookups are freed immediately upon unmounting a filesystem without waiting for active path lookups to complete. A local user could exploit this race condition to trigger a use-after-free vulnerability, resulting in a Denial of Service (DoS) via a system crash or potential memory corruption."], "name": "CVE-2026-99180", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-10-28T10:35:33Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99180\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99180\nhttps://git.kernel.org/stable/c/2b54d3c971a1e5df3c9b0bcc10311ae6c29e79d8\nhttps://git.kernel.org/stable/c/6560c3d9a6925e3747d9ad8463e16010c31ba715\nhttps://git.kernel.org/stable/c/a96c5299bd7305eb984377681eb3222a57376405"], "statement": "This vulnerability is rated as Moderate because exploitation is restricted to local attackers, requires non-default filesystem configurations, and depends on winning a narrow timing window to achieve a denial of service. In typical Red Hat Enterprise Linux environments, Unicode casefolding is not enabled by default on supported filesystems such as ext4 or tmpfs. Triggering the flaw requires a local user to race an in-flight directory path lookup against the asynchronous release of the final reference to an unmounted casefolded volume.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b886ee3e778ec2ad43e276fd378ab492cf6819b7,2b54d3c971a1e5df3c9b0bcc10311ae6c29e79d8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b886ee3e778ec2ad43e276fd378ab492cf6819b7,6560c3d9a6925e3747d9ad8463e16010c31ba715)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b886ee3e778ec2ad43e276fd378ab492cf6819b7,a96c5299bd7305eb984377681eb3222a57376405)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b886ee3e778ec2ad43e276fd378ab492cf6819b7,2b54d3c971a1e5df3c9b0bcc10311ae6c29e79d8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b886ee3e778ec2ad43e276fd378ab492cf6819b7,6560c3d9a6925e3747d9ad8463e16010c31ba715)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b886ee3e778ec2ad43e276fd378ab492cf6819b7,a96c5299bd7305eb984377681eb3222a57376405)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T13:30:20.644052+00:00", "updated": "2026-11-03T02:30:07.569266+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}