Strix
73.1K

CVE-2026-98553

Unknown

Last modified

CVE-2026-98553 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi->pipe file reference leak in autofs_kill_sb() When autofs_fill_super() fails before clearing AUTOFS_SBI_CATATONIC (for example, when find_get_pid() fails on an invalid pgrp mount option, or when an fs_context is closed before mounting), deactivate_locked_super() invokes autofs_kill_sb() -> autofs_catatonic_mode(sbi). Because AUTOFS_SBI_CATATONIC is still set in sbi->flags, autofs_catatonic_mode() returns early without calling fput(sbi->pipe), permanently leaking the pipe struct file reference. Explicitly release sbi->pipe in autofs_kill_sb() if it is still non-NULL after autofs_catatonic_mode()..

Description

In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi->pipe file reference leak in autofs_kill_sb() When autofs_fill_super() fails before clearing AUTOFS_SBI_CATATONIC (for example, when find_get_pid() fails on an invalid pgrp mount option, or when an fs_context is closed before mounting), deactivate_locked_super() invokes autofs_kill_sb() -> autofs_catatonic_mode(sbi). Because AUTOFS_SBI_CATATONIC is still set in sbi->flags, autofs_catatonic_mode() returns early without calling fput(sbi->pipe), permanently leaking the pipe struct file reference. Explicitly release sbi->pipe in autofs_kill_sb() if it is still non-NULL after autofs_catatonic_mode().

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7, < 3684e2273ba94553af3c5195a46a50214a1a96e3; >= ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7, < 0662b1ff9b383d5a233d344e4dc518c27a17f7b8; >= ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7, < 34fa4c1c6e10507dc60e35a82cc9655666946cfd; >= ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7, < a58593b501b7be5ad2bc5181bfa8cd4599be257c; >= ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7, < f1c57f5b16bbc3571bd479c290996c4d4e1fb931; >= ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7, < 4bcb371019097d0e357f097902587401c509bbc9; >= ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7, < fc4fd0281ac80b5a3c5a2330f688f0f9d2a420b6; >= ebc921ca9b92a3cf304d99bd7b7f373ec78c7ed7, < aa5e44b29ffe4eaa08cc2237fd65bc2596bc023e
LinuxLinux4.18

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-98553?
In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi->pipe file reference leak in autofs_kill_sb() When autofs_fill_super() fails before clearing AUTOFS_SBI_CATATONIC (for example, when find_get_pid() fails on an invalid pgrp mount option, or when an fs_context is closed before mounting), deactivate_locked_super() invokes autofs_kill_sb() -> autofs_catatonic_mode(sbi). Because AUTOFS_SBI_CATATONIC is still set in sbi->flags, autofs_catatonic_mode() returns early without calling fput(sbi->pipe), permanently leaking the pipe struct file reference. Explicitly release sbi->pipe in autofs_kill_sb() if it is still non-NULL after autofs_catatonic_mode().
How severe is CVE-2026-98553?
Severity scoring for CVE-2026-98553 is pending analysis.
How do I fix CVE-2026-98553?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-98553?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST