CVE-2026-98553 Overview
CVE-2026-98553 is a resource leak vulnerability in the Linux kernel's autofs filesystem. The flaw resides in autofs_kill_sb() and causes a persistent file reference leak on the sbi->pipe structure when superblock initialization fails. When autofs_fill_super() fails before clearing the AUTOFS_SBI_CATATONIC flag, the cleanup path autofs_catatonic_mode() returns early without calling fput(sbi->pipe), permanently leaking the pipe struct file reference. The fix explicitly releases sbi->pipe in autofs_kill_sb() if it remains non-NULL after autofs_catatonic_mode() completes.
Critical Impact
Repeated triggering of the failure path can exhaust kernel file descriptors and memory, leading to local denial of service on affected systems.
Affected Products
- Linux kernel (autofs subsystem)
- Multiple stable branches referenced by backported commits
- Distributions shipping affected upstream kernel versions
Discovery Timeline
- 2026-10-18 - CVE-2026-98553 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-98553
Vulnerability Analysis
The vulnerability is a kernel memory leak [CWE-401] triggered during a failed autofs superblock mount. The autofs filesystem uses a pipe to communicate between the kernel and the userspace automount daemon. The sbi->pipe field holds a reference to that pipe's struct file.
During normal shutdown, autofs_catatonic_mode() is responsible for releasing the pipe reference with fput(sbi->pipe). However, when AUTOFS_SBI_CATATONIC is already set in sbi->flags, the function returns early. If the superblock fill operation never cleared that flag because initialization failed early, the cleanup path skips the required fput() call.
Failure conditions include find_get_pid() returning an error on an invalid pgrp mount option, or an fs_context being closed before mounting completes. Each failed attempt leaks a kernel file reference tied to the pipe, consuming resources that cannot be reclaimed without a reboot.
Root Cause
The root cause is an ordering flaw in error-handling logic. autofs_fill_super() sets AUTOFS_SBI_CATATONIC early and relies on later code to clear it on success. When failure occurs between those two points, the catatonic flag remains set, causing autofs_catatonic_mode() to short-circuit cleanup and skip the pipe fput().
Attack Vector
Exploitation requires local access and the ability to mount autofs filesystems or supply mount options. An attacker with the necessary capabilities can repeatedly trigger failed mount attempts using crafted pgrp values or by closing fs_context handles before mounting completes. Each iteration leaks a kernel pipe file reference, degrading system stability over time.
No verified public exploit code is available. See the upstream fix in Kernel Commit 0662b1f for the corrective patch.
Detection Methods for CVE-2026-98553
Indicators of Compromise
- Growing kernel memory consumption attributable to open pipe file structures without corresponding user processes.
- Repeated failed autofs mount attempts in system logs referencing invalid pgrp options or truncated mount sequences.
- Rising counts in /proc/slabinfo for pipe-related slab caches on hosts that mount autofs.
Detection Strategies
- Audit kernel logs (dmesg, journalctl -k) for repeated autofs mount failures from unprivileged or containerized workloads.
- Monitor the running kernel version against the fixed commits listed in the upstream references and flag hosts still on vulnerable builds.
- Correlate mount syscall telemetry with filesystem type autofs to identify abnormal mount-failure patterns.
Monitoring Recommendations
- Baseline normal autofs mount activity per host and alert on bursts of failed mounts within short windows.
- Track long-term trends in kernel slab memory usage to surface slow leaks before service impact.
- Review container and namespace policies to confirm which workloads can issue autofs mount calls.
How to Mitigate CVE-2026-98553
Immediate Actions Required
- Inventory Linux hosts running kernels that include the autofs subsystem and identify builds without the fix.
- Apply the stable kernel update containing the patch and schedule a reboot to load the corrected kernel.
- Restrict the ability to mount autofs filesystems to trusted administrators where feasible.
Patch Information
The upstream fix explicitly releases sbi->pipe in autofs_kill_sb() if it is still non-NULL after autofs_catatonic_mode(). Backports are available across stable branches. Reference commits: 0662b1f, 34fa4c1, 3684e22, 4bcb371, a58593b, aa5e44b, f1c57f5, and fc4fd02.
Workarounds
- Limit CAP_SYS_ADMIN and user-namespace privileges that permit autofs mounts from untrusted contexts.
- Validate mount options programmatically in orchestration layers to prevent invalid pgrp values from reaching the kernel.
- Reboot periodically on long-lived hosts that cannot yet be patched to reclaim leaked kernel resources.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
