CVE-2026-89767: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89767 Overview

CVE-2026-89767 is a Linux kernel vulnerability in the OverlayFS (ovl) subsystem. The ovl_create_real() function releases the same dentry twice when a casefold consistency check fails during directory creation. This double invocation of end_creating() triggers a duplicate inode_unlock() on the parent directory and a duplicate dput() on the dentry. An unprivileged user in a user namespace can reach this path and wedge every subsequent creation under the affected parent directory.

Critical Impact
A local unprivileged user can trigger a double-unlock of a parent directory's i_rwsem and a reference count underflow, causing indefinite hangs on subsequent OverlayFS creation operations and potential kernel-level corruption.

Affected Products

Linux kernel with OverlayFS supporting casefold consistency checks
Kernel builds containing commit dfc7da402ccc ("ovl: Check for casefold consistency when creating new dentries")
Kernel builds containing commit fe497f0759e0 ("VFS: change vfs_mkdir() to unlock on failure")

Discovery Timeline

2026-09-11 - CVE-2026-89767 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89767

Vulnerability Analysis

The defect resides in fs/overlayfs inside ovl_create_real(). When handling the S_IFDIR branch, the function calls ovl_do_mkdir() and then validates casefold consistency between the overlay superblock (ofs->casefold) and the newly created dentry. On mismatch, the branch calls end_creating(newdentry) and sets err = -EINVAL. Execution then falls through to the common out: label, which calls end_creating(newdentry) again on the same dentry.

end_creating() is an alias of end_dirop(), which performs inode_unlock() on the parent directory and dput() on the dentry. The second call unlocks an i_rwsem that is no longer held and drops a reference that was never taken. This wedges all subsequent creations under that parent, since the semaphore state is now corrupted [CWE-667, CWE-415].

Root Cause

Commit dfc7da402ccc introduced the casefold consistency check with a bare dput(), which already released the reference twice. Commit fe497f0759e0 converted both sites to end_creating() as part of the VFS change to unlock on failure, compounding the issue with a duplicate inode_unlock(). The correct pattern, followed by every other error path in the function, is to set err and let the out: label handle cleanup exclusively.

Attack Vector

An unprivileged local user can reach the flaw via user namespaces. While casefold consistency is validated at mount time in ovl_parse_layer() and per-lookup in ovl_lookup_single(), the internal work subdirectory created inside the user-supplied workdir is not re-checked. Marking ofs->workdir as casefolded after mount causes ovl_create_temp() to inherit inconsistent state. That path reaches ovl_create_real() through ovl_start_creating_temp(), which uses start_creating() with a generated name and bypasses the lookup-time check.

The reproducer uses unshare -Urm, mounts a tmpfs with casefold=utf8-12.1.0, mounts overlay on top, applies chattr +F to mnt/work/work, and triggers a directory copy-up with mkdir. The kernel emits overlayfs: wrong inherited casefold (work/#5), and the next copy-up blocks indefinitely on the parent's i_rwsem.

Detection Methods for CVE-2026-89767

Indicators of Compromise

Kernel log messages containing overlayfs: wrong inherited casefold from pr_warn_ratelimited().
Processes stuck in uninterruptible sleep (state D) with stack frames including start_creating, ovl_start_creating_temp, and ovl_copy_up_one.
Unexpected unshare invocations with -Urm flags followed by overlay mounts by non-root users.

Detection Strategies

Audit mount syscalls of type overlay where the initiating UID resides in a non-initial user namespace.
Alert on chattr +F operations targeting paths beneath overlay workdir directories.
Monitor kernel ring buffer via dmesg or journald for the wrong inherited casefold warning as a high-fidelity signal of exploit attempts.

Monitoring Recommendations

Track mkdir processes hung in D state on production Linux hosts, correlating with overlay stack traces.
Enable auditd rules for the unshare, mount, and chattr syscalls originating from unprivileged accounts.
Ship kernel log telemetry to a central SIEM to identify clusters of overlayfs warnings across the fleet.

How to Mitigate CVE-2026-89767

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable git commits 077ab8985ee2, 2fa220bc0f84, and b1aa8ab78a8e as soon as vendor builds are available.
Restrict unprivileged user namespace creation by setting kernel.unprivileged_userns_clone=0 (Debian/Ubuntu) or user.max_user_namespaces=0 where user namespaces are not required.
Inventory hosts that permit unprivileged overlay mounts and prioritize patching for multi-tenant systems and container hosts.

Patch Information

The fix removes the redundant end_creating(newdentry) call from the S_IFDIR casefold-mismatch branch and lets the shared out: label own the cleanup, matching every other error path in ovl_create_real(). See the upstream commits: 077ab8985ee2, 2fa220bc0f84, and b1aa8ab78a8e.

Workarounds

Disable unprivileged user namespaces on hosts where they are not operationally required.
Avoid mounting tmpfs with casefold= options on filesystems that back OverlayFS workdir locations.
Restrict CAP_LINUX_IMMUTABLE inside user namespaces to prevent unprivileged use of chattr +F on overlay workdirs.

bash

# Configuration example
# Disable unprivileged user namespaces (Debian/Ubuntu)
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' > /etc/sysctl.d/99-disable-userns.conf

# Alternative: cap user namespaces to zero (RHEL/generic)
sysctl -w user.max_user_namespaces=0